🇫🇷
CaduVet
2026-10-27 15:36:23
UTC ·
(2 weeks ago)
2026-10-15 12:29:34,186 fail2ban.actions \[2606\]: NOTICE \[http-overflows\] Ban 34.39.222.40
2026-10-15 16:15:58,197 fail2ban.actions \[2606\]: NOTICE \[http-overflows\] Ban 34.39.222.40
2026-10-15 19:21:36,367 fail2ban.actions ...
show more
2026-10-15 12:29:34,186 fail2ban.actions \[2606\]: NOTICE \[http-overflows\] Ban 34.39.222.40
2026-10-15 16:15:58,197 fail2ban.actions \[2606\]: NOTICE \[http-overflows\] Ban 34.39.222.40
2026-10-15 19:21:36,367 fail2ban.actions \[2606\]: NOTICE \[http-overflows\] Ban 34.39.222.40
...
show less
Brute-Force
2026-10-25 19:48:08
UTC ·
(2 weeks ago)
$f2bV_matches
Brute-Force
🇬🇧
consul.to
2026-10-22 14:40:46
UTC ·
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇲🇽
octageeks.com
2026-10-22 04:29:02
UTC ·
(3 weeks ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
yvoictra
2026-10-22 02:15:01
UTC ·
(3 weeks ago)
Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-bad-user-agent
Web App Attack
🇩🇪
yvoictra
2026-10-21 17:59:04
UTC ·
(3 weeks ago)
Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-probing
Web App Attack
🇩🇪
edena
2026-10-21 16:27:55
UTC ·
(3 weeks ago)
34.39.222.40 - - [21/Oct/2026:18:27:54 +0200] "GET /@fs/app/.env?import&raw?? HTTP/1.1" 403 380 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.39.222.40 - - [21/Oct/2026:18:27:54 +0200] "GET /.env.supabase HTTP/1.1" ...
show more
34.39.222.40 - - [21/Oct/2026:18:27:54 +0200] "GET /@fs/app/.env?import&raw?? HTTP/1.1" 403 380 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.39.222.40 - - [21/Oct/2026:18:27:54 +0200] "GET /.env.supabase HTTP/1.1" 403 1975 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.39.222.40 - - [21/Oct/2026:18:27:54 +0200] "GET /.env?raw HTTP/1.1" 403 380 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
Bad Web Bot
🇩🇪
big-cloud.nl
2026-10-21 15:59:58
UTC ·
(3 weeks ago)
Try to access /.env.development.local
Web App Attack
🇳🇱
Alt255
2026-10-21 15:52:14
UTC ·
(3 weeks ago)
[cb-04al] Excessive 404 errors (web scanning): 29 suspicious requests detected by fail2ban jail nginx-404. Example: 34.39.222.40 - - [21/Oct/2026:17:52:08 +0200] "GET /account HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Ap ...
show more
[cb-04al] Excessive 404 errors (web scanning): 29 suspicious requests detected by fail2ban jail nginx-404. Example: 34.39.222.40 - - [21/Oct/2026:17:52:08 +0200] "GET /account HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.39.222.40 - - [21/Oct/2026:17:52:08 +0200] "GET /billing HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.39.222.40 - - [21/Oct/2026:17:52:08 +0200] "GET /onboarding HTTP/1.0" 404 8563 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.39.222.40 - - [21/Oct/2026:17:52:08 +0200] "GET /forgot-password HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW
...
show less
Bad Web Bot
Web App Attack
2026-10-21 15:03:38
UTC ·
(3 weeks ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
updown.io
2026-10-21 11:13:40
UTC ·
(3 weeks ago)
{"level":"info","ts":1792581219.869418,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.39.222.40","remote_port":"41926","client_ip":"34.39.222.40","proto":"HTTP/2.0","method":"GET","host":"status.volkertek.cloud","u ...
show more
{"level":"info","ts":1792581219.869418,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.39.222.40","remote_port":"41926","client_ip":"34.39.222.40","proto":"HTTP/2.0","method":"GET","host":"status.volkertek.cloud","uri":"/media../.env","headers":{"X-Nextjs-Data":["1"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"],"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.volkertek.cloud","ech":false}},"bytes_read":0,"user_id":"","duration":0.00017293,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1792581219.8715348,"logger":"http.log.access.log1","msg":"handled re
...
show less
DDoS Attack
Web App Attack
2026-10-21 11:10:26
UTC ·
(3 weeks ago)
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /auth HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /sign-in HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /dashboard HTTP/2.0" 404 329
34.39.222.40 - - ...
show more
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /auth HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /sign-in HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /dashboard HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /build/manifest.json HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /account HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /login HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /cwcm046uy2id0xdf3u3a HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /admin HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /dist/.vite/manifest.json HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /panel HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /signin HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026:13:10:21 +0200] "GET /register HTTP/2.0" 404 329
34.39.222.40 - - [21/Oct/2026
...
show less
Web Spam
Web App Attack
🇫🇮
as211431.net
2026-10-21 09:47:08
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (POST method)
Endpoint: /icecoder/lib/terminal-xhr.php
UA: Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sh ...
show more
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (POST method)
Endpoint: /icecoder/lib/terminal-xhr.php
UA: Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇹🇷
Jova
2026-10-21 08:16:01
UTC ·
(3 weeks ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
2026-10-21 05:01:30
UTC ·
(3 weeks ago)
Web attack blocked by WAF: GET /__vite_rsc_findSourceMapURL x4, GET /.env x3, GET /z9x8c7v6b5-debug-trigger-[our-domain] (Bad file extension; Scan attempt by ByteDance crawler).
[21/Oct/2026:08:01:29 +0300] "GET /wp-admin/.env HTTP/1.1" UA="Mozilla/5 ...
show more
Web attack blocked by WAF: GET /__vite_rsc_findSourceMapURL x4, GET /.env x3, GET /z9x8c7v6b5-debug-trigger-[our-domain] (Bad file extension; Scan attempt by ByteDance crawler).
[21/Oct/2026:08:01:29 +0300] "GET /wp-admin/.env HTTP/1.1" UA="Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)" -> Direct access to sensitive file or dotfile
[21/Oct/2026:08:01:29 +0300] "GET /@fs/proc/self/cmdline?raw?? HTTP/1.1" UA="Mozilla/5.0 (compatible; Bytespider; [email]) AppleWebKit/" -> Scan attempt by ByteDance crawler
[21/Oct/2026:08:01:29 +0300] "GET /@fs/src/.env?import&raw?? HTTP/1.1" UA="Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" -> Direct access to sensitive file or dotfile
[21/Oct/2026:08:01:29 +0300] "GET /__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ&environmentName=rsc HTTP/1.1" UA="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1." -> Block System File Attempt; Suspicious inpu…
show less
Web App Attack
