🇮🇹
tome
2026-11-08 13:08:47
UTC ·
(6 days ago)
Honeypot: 110 HTTP requests 2026-10-15T14:36Z..2026-10-16T06:25Z probing /.env, /.env.local, /.env.production, /@fs/../.env, /.env.development. UA: DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot).
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-25 13:44:25
UTC ·
(2 weeks ago)
[ti-tinov] Web exploit scanning: 17 suspicious requests detected by fail2ban jail <name>. Example: 34.87.137.23 - - [19/Oct/2026:18:23:54 +0200] "GET /.env.staging.local HTTP/1.1" 404 692 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.aliba ...
show more
[ti-tinov] Web exploit scanning: 17 suspicious requests detected by fail2ban jail <name>. Example: 34.87.137.23 - - [19/Oct/2026:18:23:54 +0200] "GET /.env.staging.local HTTP/1.1" 404 692 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
34.87.137.23 - - [19/Oct/2026:18:23:54 +0200] "GET /.ssh/id_rsa HTTP/1.1" 404 692 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
34.87.137.23 - - [19/Oct/2026:18:23:54 +0200] "GET /.ssh/config HTTP/1.1" 404 692 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
34.87.137.23 - - [19/Oct/2026:18:23:54 +0200] "GET /.env.preprod HTTP/1.1" 404 692 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/d
...
show less
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-10-22 13:43:38
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /login
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
This report was gen ...
show more
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /login
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-20 22:35:23
UTC ·
(3 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇩🇪
updown.io
2026-10-20 21:46:53
UTC ·
(3 weeks ago)
{"level":"info","ts":1792532812.2851753,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.87.137.23","remote_port":"41078","client_ip":"34.87.137.23","proto":"HTTP/2.0","method":"POST","host":"status.iungoapps.com","u ...
show more
{"level":"info","ts":1792532812.2851753,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.87.137.23","remote_port":"41078","client_ip":"34.87.137.23","proto":"HTTP/2.0","method":"POST","host":"status.iungoapps.com","uri":"/graphql","headers":{"Content-Type":["application/json"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Referer":["https://status.iungoapps.com"],"Origin":["https://status.iungoapps.com"],"Content-Length":["86"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Priority":["u=1, i"],"Sec-Fetch-Site":["same-origin"],"Accept":["*/*"],"Sec-Ch-Ua-Mobile":["?0"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Ch-Ua-Platform":["\"Linux\""],"Sec-Fetch-Mode":["cors"],"Sec-Fetch-Dest":["empty"],"Accept-Language":["en-US,en;q=0.9"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.iungoapps.com
...
show less
DDoS Attack
Web App Attack
🇺🇸
oralunal
2026-10-20 19:52:32
UTC ·
(3 weeks ago)
IP banned by Fail2Ban in jail its-suss access.log mvfnds
...
Bad Web Bot
Web App Attack
🇨🇦
alexbfr
2026-10-20 19:52:25
UTC ·
(3 weeks ago)
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-20T19:52:25Z; reported_at=2026-10-20T19:52:27Z
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T ...
show more
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-20T19:52:25Z; reported_at=2026-10-20T19:52:27Z
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T19:52:25Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
show less
Web App Attack
🇳🇱
ConsulHosting
2026-10-20 19:51:19
UTC ·
(3 weeks ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
jormaster3k
2026-10-20 17:05:37
UTC ·
(3 weeks ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
Bedios GmbH
2026-10-20 16:48:42
UTC ·
(3 weeks ago)
Scanning for exposed credentials and private keys
Hacking
🇺🇦
vbios.com
2026-10-20 16:44:01
UTC ·
(3 weeks ago)
WEB_Brute-Force
Brute-Force
🇭🇳
unph
2026-10-20 16:43:26
UTC ·
(3 weeks ago)
Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin
Brute-Force
🇺🇸
iwle
2026-10-20 16:17:23
UTC ·
(3 weeks ago)
[Tue Oct 20 12:17:21.763675 2026] [:error] [pid 208565:tid 208610] [client 34.87.137.23:0] [client 34.87.137.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.p ...
show more
[Tue Oct 20 12:17:21.763675 2026] [:error] [pid 208565:tid 208610] [client 34.87.137.23:0] [client 34.87.137.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "iwle.com"] [uri "/.env.development.local"] [unique_id "ateUEZoynHd9Z9Ynw1H_fgAAANE"]
[Tue Oct 20 12:17:21.800419 2026] [:error] [pid 208565:tid 208612] [client 34.87.137.23:0] [client 34.87.137.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.en
...
show less
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-20 16:10:26
UTC ·
(3 weeks ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-10-20 15:59:06
UTC ·
(3 weeks ago)
80,443
Brute-Force
SSH
