🇩🇪
palzer.IT
2026-10-28 12:41:35
UTC ·
(2 weeks ago)
Report for plesk-apache-badbot: 34.6.159.59 - - [27/Oct/2026:13:01:52 +0100] GET /robots.txt [DOMAIN_REMOVED] 200 6008 - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@[DOMAIN_REMOVED])
Bad Web Bot
🇩🇪
LRob
2026-10-28 07:42:50
UTC ·
(2 weeks ago)
Vulnerability scanning | host: webmail.creche-lyon.fr | method: GET, POST | path: /sitemap.xml, /sitemap_index.xml, /asset-manifest.json (+17 more) | ua: CCBot/2.0 (https://commoncrawl.org/faq/), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); co ...
show more
Vulnerability scanning | host: webmail.creche-lyon.fr | method: GET, POST | path: /sitemap.xml, /sitemap_index.xml, /asset-manifest.json (+17 more) | ua: CCBot/2.0 (https://commoncrawl.org/faq/), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot, Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 (+7 more) | src_port: 45046
show less
Port Scan
Web App Attack
Anonymous
2026-10-28 06:04:13
UTC ·
(2 weeks ago)
Web application attack: grafana cve 2021 43798; Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Web application attack: http sensitive files; Probing for exposed secret / credential files
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-28 05:51:49
UTC ·
(2 weeks ago)
[ti-30al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.6.159.59 - - [28/Oct/2026:06:51:25 +0100] "GET /.env.secret HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@byted ...
show more
[ti-30al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.6.159.59 - - [28/Oct/2026:06:51:25 +0100] "GET /.env.secret HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.6.159.59 - - [28/Oct/2026:06:51:25 +0100] "GET /.env.supabase HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.6.159.59 - - [28/Oct/2026:06:51:25 +0100] "GET /.env.credentials HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.6.159.59 - - [28/Oct/2026:06:51:25 +0100] "GET /.env.keys HTTP/2.0" 403 556 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
...
show less
Bad Web Bot
Web App Attack
🇳🇦
jacqueskruger
2026-10-28 01:16:06
UTC ·
(2 weeks ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 2 confirmed alerts / 4 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-27T21:13:12Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 2 confirmed alerts / 4 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-27T21:13:12Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇮🇹
CoreTech srl
2026-10-27 15:24:03
UTC ·
(2 weeks ago)
cloudlinux2 fail2ban: 2026-10-27 16:19:00,083 fail2ban.filter [1596]: INFO [plesk-wordpress] Found 82.25.175.9 - 2026-10-27 16:18:59cloudlinux2 fail2ban: 2026-10-27 16:19:23,665 fail2ban.filter [1596]: INFO [plesk-wordpress] Fou ...
show more
cloudlinux2 fail2ban: 2026-10-27 16:19:00,083 fail2ban.filter [1596]: INFO [plesk-wordpress] Found 82.25.175.9 - 2026-10-27 16:18:59cloudlinux2 fail2ban: 2026-10-27 16:19:23,665 fail2ban.filter [1596]: INFO [plesk-wordpress] Found 47.20.117.87 - 2026-10-27 16:19:23cloudlinux2 fail2ban: 2026-10-27 16:20:49,578 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 23.239.27.128 - 2026-10-27 16:20:49cloudlinux2 fail2ban: 2026-10-27 16:20:59,484 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 23.239.27.128 - 2026-10-27 16:20:59cloudlinux2 fail2ban: 2026-10-27 16:23:27,059 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 34.6.159.59 - 2026-10-27 16:23:27cloudlinux2 fail2ban: 2026-10-27 16:23:27,049 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 34.6.159.59 - 2026-10-27 16:23:27cloudlinux2 fail2ban: 2026-10-27 16:23:27,070 fail2ban.filter [1596]: INFO [plesk-modsecurity] Found 34.6.159.59 - 2026-10-27 16:23:27cloudlin
show less
Web App Attack
🇩🇪
palzer.IT
2026-10-27 12:02:00
UTC ·
(2 weeks ago)
Report for plesk-apache-badbot: 34.6.159.59 - - [27/Oct/2026:13:01:52 +0100] GET /robots.txt [DOMAIN_REMOVED] 200 6008 - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@[DOMAIN_REMOVED])
Bad Web Bot
🇮🇹
VHosting
2026-10-27 06:00:05
UTC ·
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-27 04:55:17
UTC ·
(2 weeks ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-27 01:25:55
UTC ·
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇦
jacqueskruger
2026-10-27 01:01:54
UTC ·
(2 weeks ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-27T00:59:24Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-27T00:59:24Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
Anonymous
2026-10-26 21:18:00
UTC ·
(2 weeks ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-26 20:43:23
UTC ·
(2 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇬🇧
Apache
2026-10-26 19:59:05
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:930120) triggered by 34.6.159.59 (NL/The Netherlands/59.159.6.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
Brute-Force
Web App Attack
🇳🇴
jad-abuse
2026-10-26 18:33:33
UTC ·
(2 weeks ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, aws_creds, path_traversal, dotfile_probe, source_backup, git_exposure, credential_file, actuator. Observed by 1 sensor(s); 700 hits.
Hacking
Web App Attack