AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Bete joined AbuseIPDB in January 2025 and has reported 721 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇷🇺 149.126.102.98	24 Apr 2025	A brute-force attack from IP 149.126.102.98 via NTLM authentication, with rapid sequential attempts ... show more A brute-force attack from IP 149.126.102.98 via NTLM authentication, with rapid sequential attempts to guess passwords for accounts. show less	Brute-Force
🇲🇩 159.253.120.107	24 Apr 2025	159.253.120.107 - - [23/Apr/2025:16:32:20 +0300] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 68 ... show more 159.253.120.107 - - [23/Apr/2025:16:32:20 +0300] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 682 "-" "python-requests/2.27.1" An automated phpMyAdmin vulnerability probe from IP 159.253.120.107, where the attacker specifically targeted the setup.php script in phpMyAdmin's /scripts/ directory using a Python Requests library user-agent, which is a known attack vector that could allow remote code execution in vulnerable phpMyAdmin versions. show less	Web App Attack
🇳🇱 196.251.81.150	24 Apr 2025	196.251.81.150 - - [24/Apr/2025:03:39:27 +0300] "GET /pma2005/ HTTP/1.1" 404 682 "https://196.188.10 ... show more 196.251.81.150 - - [24/Apr/2025:03:39:27 +0300] "GET /pma2005/ HTTP/1.1" 404 682 "https://196.188.108.34/" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1" 196.251.81.150 - - [24/Apr/2025:03:39:26 +0300] "GET /mysqlmanager/ HTTP/1.1" 404 682 "https://196.188.108.34/" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1" A targeted scan for phpMyAdmin installations from IP 196.251.81.150, where the attacker systematically checked for multiple outdated phpMyAdmin versions (2.8.0.1 through 2.8.2) and alternative database management paths (/pma2005/, /mysqlmanager/, /sqlmanager/) using a spoofed Firefox 9.0.1 user agent on Windows XP. show less	Brute-Force Web App Attack
🇭🇰 43.155.14.19	23 Apr 2025	43.155.14.19 - - [22/Apr/2025:20:08:08 +0300] "GET /data.rar HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Mac ... show more 43.155.14.19 - - [22/Apr/2025:20:08:08 +0300] "GET /data.rar HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36 OPR/51.0.2830.55" 43.155.14.19 - - [22/Apr/2025:20:08:08 +0300] "GET /bbs.sql.gz HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.80 Safari/537.36 OPR/56.0.3051.116" An automated scan for exposed backup and database files from IP 43.155.14.19, where the attacker systematically probed for archives (.rar, .7z, .tar.tgz), database dumps (.sql, .sql.gz), and Java/web application files (.jar, .zip) using spoofed user agents mimicking outdated browsers on multiple platforms (macOS, Windows, Linux). show less	Brute-Force Web App Attack
🇳🇱 195.178.110.161	22 Apr 2025	195.178.110.161 - - [21/Apr/2025:19:48:23 +0000] "GET /.env.local HTTP/1.1" 404 134 "-" "l9explore/1 ... show more 195.178.110.161 - - [21/Apr/2025:19:48:23 +0000] "GET /.env.local HTTP/1.1" 404 134 "-" "l9explore/1.2.2" 195.178.110.161 - - [21/Apr/2025:19:48:22 +0000] "GET /.git/config HTTP/1.1" 404 134 "-" "l9explore/1.2.2" 195.178.110.161 - - [21/Apr/2025:19:48:22 +0000] "GET /django/.env HTTP/1.1" 404 134 "-" "l9explore/1.2.2" This log captures an automated credential harvesting attack from IP 195.178.110.161 using the l9explore/1.2.2 scanner (a known security testing tool), which systematically probed for sensitive .env files across multiple directories (including /django/, /app/config/dev/, /.docker/, and /admin/) and attempted to access Git configuration (/.git/config). show less	Brute-Force Web App Attack
🇬🇧 198.244.229.224	21 Apr 2025	198.244.229.224 - - [19/Apr/2025:20:55:33 +0000] "GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1" 40 ... show more 198.244.229.224 - - [19/Apr/2025:20:55:33 +0000] "GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1" 404 162 "-" "curl/7.54.0" 198.244.229.224 - - [19/Apr/2025:20:55:34 +0000] "GET /localstart.cfm HTTP/1.1" 404 162 "-" "curl/7.54.0" This IP 198.244.229.224 conducted a systematic scan for administration interfaces across multiple platforms using curl/7.54.0, including: common admin paths (admin.php, admin.pl), CMS-specific endpoints (Joomla's joomla.xml, ColdFusion's, localstart.cfm), application servers (WebObjects/Helpdesk.woa, zxtm/login.cgi), and version disclosure (/api/server/version) show less	Brute-Force Web App Attack
🇳🇱 192.142.0.158	21 Apr 2025	192.142.0.158 - - [18/Apr/2025:19:44:50 +0000] "GET /info.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Wi ... show more 192.142.0.158 - - [18/Apr/2025:19:44:50 +0000] "GET /info.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0" 192.142.0.158 - - [18/Apr/2025:19:44:49 +0000] "GET /_profiler/phpinfo HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" A sophisticated reconnaissance attack from IP 192.142.0.158 (with an initial typo as 92.142.0.158) conducting comprehensive probing for sensitive files across multiple frameworks, including: PHP information leaks (phpinfo.php, info.php, Symfony's _profiler/phpinfo), framework configuration files (parameters.yml, OwnCloud's GetPhpInfo.php), and development tools (Symfony's app_dev.php) show less	Brute-Force Web App Attack
🇸🇬 43.128.72.97	21 Apr 2025	43.128.72.97 - - [19/Apr/2025:03:46:36 +0000] "GET /actuator/ HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Wi ... show more 43.128.72.97 - - [19/Apr/2025:03:46:36 +0000] "GET /actuator/ HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))" 43.128.72.97 - - [19/Apr/2025:03:46:26 +0000] "GET /env.json HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))" A targeted Spring Boot Actuator probe from IP 43.128.72.97, where the attacker systematically checked for exposed Actuator endpoints (/env, /mappings, and the path-traversal attempt /actuator/;/env). show less	Brute-Force Web App Attack
🇺🇸 13.66.246.180	21 Apr 2025	13.66.246.180 - - [20/Apr/2025:21:30:11 +0000] "GET /phpinfo.php HTTP/1.1" 404 134 "-" "Mozilla/5.0 ... show more 13.66.246.180 - - [20/Apr/2025:21:30:11 +0000] "GET /phpinfo.php HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 13.66.246.180 - - [20/Apr/2025:21:30:10 +0000] "GET /config.json HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" An automated reconnaissance activity from IP 13.66.246.180, where the attacker systematically probed for sensitive files and debugging endpoints including PHP information leaks (phpinfo.php, _profiler/phpinfo), configuration files (.env, .env.project, config.json), Yii framework debug panels (/debug/default/view), and Symfony development tools (frontend_dev.php). show less	Brute-Force Web App Attack
🇸🇪 172.232.159.13	21 Apr 2025	172.232.159.13 - - [19/Apr/2025:20:02:24 +0300] "GET /indice.cfm HTTP/1.1" 404 682 "-" "curl/7.54.0" ... show more 172.232.159.13 - - [19/Apr/2025:20:02:24 +0300] "GET /indice.cfm HTTP/1.1" 404 682 "-" "curl/7.54.0" 172.232.159.13 - - [19/Apr/2025:20:02:24 +0300] "GET /inicio.jhtml HTTP/1.1" 404 682 "-" "curl/7.54.0" Automated scanning activity from IP 172.232.159.13 (with an initial typo showing as 72.232.159.13), where the attacker conducted a multi-technology probe by checking for common web administration interfaces and index files across different platforms - testing ColdFusion (indice.cfm), Java (admin.jsp, inicio.jhtml), Perl (base.pl, indice.pl), and basic HTTP access, using both blank user-agent requests and curl/7.54.0. show less	Web App Attack
🇺🇸 13.78.163.10	21 Apr 2025	13.78.163.10 - - [20/Apr/2025:23:17:07 +0300] "GET /phpinfo.php HTTP/1.1" 404 682 "-" "Mozilla/5.0 ( ... show more 13.78.163.10 - - [20/Apr/2025:23:17:07 +0300] "GET /phpinfo.php HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 13.78.163.10 - - [20/Apr/2025:23:17:06 +0300] "GET /_profiler/phpinfo HTTP/1.1" 404 682 "-" Reconnaissance activity from IP 13.78.163.10, where an attacker probed for sensitive files and PHP information leaks by attempting to access phpinfo.php, /_profiler/phpinfo, /?phpinfo=1, and various configuration files (.json, config.json) using a spoofed Firefox 77 user agent (Mac OS X) show less	Web App Attack
🇺🇸 167.172.230.171	17 Apr 2025	167.172.230.171 - - [16/Apr/2025:12:18:51 +0000] "GET //news/wp-includes/wlwmanifest.xml HTTP/1.1" 4 ... show more 167.172.230.171 - - [16/Apr/2025:12:18:51 +0000] "GET //news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 61016 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 167.172.230.171 - - [16/Apr/2025:12:18:50 +0000] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 61016 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 167.172.230.171 - - [16/Apr/2025:12:18:50 +0000] "GET //sito/wp-includes/wlwmanifest.xml HTTP/1.1" 404 275 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" A WordPress reconnaissance attack from IP 167.172.230.171, where the attacker probed for the wlwmanifest.xml file in multiple directories (//news/wp-includes/, //wp/wp-includes/, //sito/wp-includes/,...) using a spoofed Chrome 78 user-agent show less	Brute-Force Web App Attack
🇺🇸 107.150.0.115	17 Apr 2025	107.150.0.115 - - [17/Apr/2025:05:19:17 +0000] "GET /config/settings.json HTTP/1.1" 404 33 "-" "Mozi ... show more 107.150.0.115 - - [17/Apr/2025:05:19:17 +0000] "GET /config/settings.json HTTP/1.1" 404 33 "-" "Mozilla/5.0" 107.150.0.115 - - [17/Apr/2025:05:19:16 +0000] "GET /config/secrets.json HTTP/1.1" 404 33 "-" "Mozilla/5.0" 107.150.0.115 - - [17/Apr/2025:05:19:14 +0000] "GET /react-app/.env.production HTTP/1.1" 404 12109 "-" "Mozilla/5.0" 107.150.0.115 - - [17/Apr/2025:05:19:12 +0000] "GET /.envs/.production/.django HTTP/1.1" 404 12110 "-" "Mozilla/5.0" The logs show automated scanning activity from 107.150.0.115, where the attacker attempted to access sensitive configuration files like /config/settings.json, /config/secrets.json, and multiple .env files (including /react-app/.env, /.env.production, /myproject/.env,...) using a generic Mozilla/5.0 user-agent show less	Brute-Force Web App Attack
🇸🇬 43.128.72.97	17 Apr 2025	43.128.72.97 - - [16/Apr/2025:16:10:56 +0000] "GET /api/actuator/ HTTP/1.1" 404 162 "-" "Mozilla/5.0 ... show more 43.128.72.97 - - [16/Apr/2025:16:10:56 +0000] "GET /api/actuator/ HTTP/1.1" 404 162 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; nb-no) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148a Safari/6533.18.5" 43.128.72.97 - - [16/Apr/2025:16:10:55 +0000] "GET /actuator/;/env HTTP/1.1" 404 162 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; nb-no) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148a Safari/6533.18.5" 43.128.72.97 - - [16/Apr/2025:16:10:54 +0000] "GET /actuator/env HTTP/1.1" 404 162 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; nb-no) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148a Safari/6533.18.5" This log shows automated scanning activity from 43.128.72.97, where the attacker probed for Spring Boot Actuator endpoints (/actuator/env, /api/actuator/, and a potential path traversal attempt /actuator/;/env) using a spoofed iPhone Safari (iOS 4.2.1) user agent to disguise the requests show less	Brute-Force Web App Attack
🇷🇺 185.7.214.89	17 Apr 2025	A brute-force attack from IP 185.7.214.89 via NTLM authentication, with rapid sequential attempts to ... show more A brute-force attack from IP 185.7.214.89 via NTLM authentication, with rapid sequential attempts to guess passwords for accounts. show less	Brute-Force
🇨🇳 112.81.90.243	16 Apr 2025	112.81.90.243 - - [16/Apr/2025:01:15:30 -0400] "GET /.env.bak HTTP/1.1" 404 153 "-" "Mozilla/5.0 (iP ... show more 112.81.90.243 - - [16/Apr/2025:01:15:30 -0400] "GET /.env.bak HTTP/1.1" 404 153 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1" "-" An attempted security breach from IP 112.81.90.243, where the attacker tried to access a backup environment file (/.env.bak) using what appears to be a spoofed iPhone Safari browser (iOS 17.5.1) user agent. show less	Spoofing Brute-Force Web App Attack
🇫🇷 154.83.103.179	16 Apr 2025	154.83.103.179 - - [15/Apr/2025:19:13:09 +0000] "GET /aws/.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (W ... show more 154.83.103.179 - - [15/Apr/2025:19:13:09 +0000] "GET /aws/.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 154.83.103.179 - - [15/Apr/2025:19:13:09 +0000] "GET /aws/.env.local HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 154.83.103.179 - - [15/Apr/2025:19:13:10 +0000] "GET /aws/.env.production HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" A common automated attack targeting misconfigured web servers from 154.83.103.179 to access sensitive .env configuration files (/.env, /.env.local, /.env.production,...) in the /aws/ directory, likely searching for exposed AWS credentials, API keys, or database secrets. show less	Brute-Force Web App Attack
🇸🇬 46.137.239.224	16 Apr 2025	46.137.239.224 - - [16/Apr/2025:01:54:05 +0000] "GET /sqlite.zip HTTP/1.1" 404 564 "-" "Mozilla/5.0 ... show more 46.137.239.224 - - [16/Apr/2025:01:54:05 +0000] "GET /sqlite.zip HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 46.137.239.224 - - [16/Apr/2025:01:54:05 +0000] "GET /mailer.zip HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 46.137.239.224 - - [16/Apr/2025:01:54:05 +0000] "GET /root.zip HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" Automated scanning activity from IP 46.137.239.224, where the attacker attempted to download common archive files (sqlite.zip, mailer.zip, root.zip,...) in quick succession. show less	Brute-Force Web App Attack
🇨🇳 117.133.133.87	16 Apr 2025	117.133.133.87 - - [15/Apr/2025:23:05:03 +0300] "GET /index.php?lang=../../../../../../../../tmp/ind ... show more 117.133.133.87 - - [15/Apr/2025:23:05:03 +0300] "GET /index.php?lang=../../../../../../../../tmp/index1 HTTP/1.1" 404 682 "-" "Custom-AsyncHttpClient" This log entry records a failed Local File Inclusion (LFI) / Directory Traversal attack from IP 117.133.133.87, where the attacker attempted to exploit the lang parameter in index.php to access /tmp/index1 using a path traversal payload. show less	Brute-Force Web App Attack
🇺🇸 34.16.177.230	14 Apr 2025	34.16.177.230 - - [12/Apr/2025:15:12:02 +0000] "GET /.well-known/passkey-endpoints HTTP/1.1" 404 121 ... show more 34.16.177.230 - - [12/Apr/2025:15:12:02 +0000] "GET /.well-known/passkey-endpoints HTTP/1.1" 404 12114 "https://member.redcrosseth.org/signup/accept-agreement" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36 PTST/250402.153735" 34.16.177.230 - - [12/Apr/2025:15:12:02 +0000] "GET /.well-known/web-identity HTTP/1.1" 404 12112 "https://member.redcrosseth.org/signup/accept-agreement" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36 PTST/250402.153735" This log entry shows requests from 34.16.177.230 is attempting to access well-known security and identity-related files in the /.well-known/ directory show less	Web App Attack
🇺🇸 34.28.15.164	14 Apr 2025	34.28.15.164 - - [13/Apr/2025:08:36:30 +0000] "GET /.well-known/security.txt HTTP/1.1" 404 31 "https ... show more 34.28.15.164 - - [13/Apr/2025:08:36:30 +0000] "GET /.well-known/security.txt HTTP/1.1" 404 31 "https://member.redcrosseth.org/signup/accept-agreement" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 PTST/250402.153735" 34.28.15.164 - - [13/Apr/2025:08:36:30 +0000] "GET /.well-known/web-identity HTTP/1.1" 404 12112 "https://member.redcrosseth.org/signup/accept-agreement" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 PTST/250402.153735" 34.28.15.164 - - [13/Apr/2025:08:36:30 +0000] "GET /.well-known/apple-app-site-association HTTP/1.1" 404 12119 "https://member.redcrosseth.org/signup/accept-agreement" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 PTST/250402.153735" This log shows requests from 34.28.15.164 attempting to access well-known security and identity-related files in the /.well-known/ directory. show less	Web App Attack
🇾🇪 89.189.68.39	14 Apr 2025	89.189.68.39 - - [12/Apr/2025:23:43:43 +0300] "GET /app/kibana HTTP/1.1" 404 682 "-" "Mozilla/5.0 (U ... show more 89.189.68.39 - - [12/Apr/2025:23:43:43 +0300] "GET /app/kibana HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 89.189.68.39 - - [12/Apr/2025:23:43:42 +0300] "GET /logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain) HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Fedora; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 89.189.68.39 - - [12/Apr/2025:23:43:41 +0300] "GET /command.cgi?cat%20/etc/passwd HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" The log shows malicious activity from IP 89.189.68.39, attempting various attacks, including probing for exposed services, XSS, and command injection. show less	Brute-Force Web App Attack
🇾🇪 89.189.74.70	14 Apr 2025	89.189.74.70 - - [13/Apr/2025:18:30:41 +0300] "GET /getGfiUpgradeFile?fileName=../../../../../../../ ... show more 89.189.74.70 - - [13/Apr/2025:18:30:41 +0300] "GET /getGfiUpgradeFile?fileName=../../../../../../../etc/passwd HTTP/1.1" 404 682 "-" "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" 89.189.74.70 - - [13/Apr/2025:18:30:39 +0300] "GET /common/download/resource?resource=/profile/../../../../etc/passwd HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.2.17" 89.189.74.70 - - [13/Apr/2025:18:30:39 +0300] "GET /sysaid/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd HTTP/1.1" 404 682 "-" "Mozilla/5.0 (SS; Linux i686; rv:120.0) Gecko/20100101 Firefox/120.0" The log shows multiple attempts by the IP address 89.189.74.70 to exploit path traversal vulnerabilities in different web applications. This attacker is trying to access sensitive system files (/etc/passwd) by manipulating file path parameters show less	Brute-Force Web App Attack
🇺🇸 34.86.52.35	11 Apr 2025	34.86.52.35 - - [10/Apr/2025:23:34:20 +0000] "GET /.well-known/security.txt HTTP/1.1" 404 31 "https: ... show more 34.86.52.35 - - [10/Apr/2025:23:34:20 +0000] "GET /.well-known/security.txt HTTP/1.1" 404 31 "https://member.redcrosseth.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 PTST/250402.153735" 34.86.52.35 - - [10/Apr/2025:23:34:20 +0000] "GET /.well-known/web-identity HTTP/1.1" 404 12112 "https://member.redcrosseth.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 PTST/250402.153735" show less	Web App Attack
🇺🇸 104.196.163.251	10 Apr 2025	The logs are showing a wave of requests for standard ".well-known" files, most of which are part of ... show more The logs are showing a wave of requests for standard ".well-known" files, most of which are part of browser privacy initiatives, federated identity systems, or mobile app integrations. 104.196.163.251 - - [10/Apr/2025:01:21:00 +0000] "GET /.well-known/related-website-set.json HTTP/1.1" 404 33 "https://member.redcrosseth.org/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36 PTST/250402.153735" show less	Web App Attack