🇩🇪
EGP Abuse Dept
2026-10-26 03:10:48
(3 days ago)
Scanning for port/service exploits on tpc-001.mach3builders.nl
Port Scan
Hacking
2026-10-26 03:07:09
(3 days ago)
Drop from IP address 134.122.33.94 to tcp-port 8888
Port Scan
2026-10-15 04:32:57
(2 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇸🇪
Per-Erik Runebert
2026-10-14 08:39:35
(2 weeks ago)
Excessive unauthorized requests
Hacking
🇬🇧
openstrike.co.uk
2026-10-14 05:14:02
(2 weeks ago)
5 attacks on site downloads (type 2), VC URLs, PHP URLs, env grabbing URLs, Laravel URLs:
GET /demo HTTP/1.1
GET /.git/config HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.env HTTP/1.1
GET /_ignition/execute-solutio ...
show more
5 attacks on site downloads (type 2), VC URLs, PHP URLs, env grabbing URLs, Laravel URLs:
GET /demo HTTP/1.1
GET /.git/config HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.env HTTP/1.1
GET /_ignition/execute-solution HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
IVski.com
2026-10-14 01:05:27
(2 weeks ago)
IVski WAF | Suspicious activity detected - generic bot or scanner pattern
Hacking
Brute-Force
Web App Attack
2026-10-13 10:35:48
(2 weeks ago)
[Firewall Canary] Temporary ban due to firewall rule match [URI:*/vendor/*]
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-13 10:32:55
(2 weeks ago)
[TueOct1312:32:50.5434432026][security2:error][pid922595:tid922690][client134.122.33.94:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\^0\$\"against\"REQUEST_HEADERS:Content-Length\"required.[file\"/etc/apache2/conf.d/modsec_rules/10_asl ...
show more
[TueOct1312:32:50.5434432026][security2:error][pid922595:tid922690][client134.122.33.94:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\^0\$\"against\"REQUEST_HEADERS:Content-Length\"required.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"88\"][id\"392301\"][rev\"8\"][msg\"Atomicorp.comWAFRules:RequestContainingContent\,butMissingContent-Typeheader\"][severity\"NOTICE\"][tag\"no_ar\"][hostname\"safeoncloud.ch\"][uri\"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php\"][unique_id\"as4I0mOVc2TJR3LFEora4QAAAQU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 10:30:56
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 134.122.33.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:30:51.099428 2026] [security2:error] [pid 11322:tid 11322] [client 134.122.33.94:46516] M ...
show more
(mod_security) mod_security (id:210492) triggered by 134.122.33.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:30:51.099428 2026] [security2:error] [pid 11322:tid 11322] [client 134.122.33.94:46516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.safekit.abecasis.com"] [uri "/.env"] [unique_id "as4IWxj8j1aOE-4AbjkZHAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 09:48:44
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 134.122.33.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:48:38.221659 2026] [security2:error] [pid 27006:tid 27006] [client 134.122.33.94:40474] M ...
show more
(mod_security) mod_security (id:210492) triggered by 134.122.33.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:48:38.221659 2026] [security2:error] [pid 27006:tid 27006] [client 134.122.33.94:40474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sabri.es"] [uri "/.env"] [unique_id "as3-dsOFFUToxCgmLcIWoAAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
spot
2026-10-13 09:21:35
(2 weeks ago)
134.122.33.94 - - [13/Oct/2026:10:21:34 +0100] "GET /.env HTTP/1.1" 404 488 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
Web App Attack
VPN IP
🇩🇪
maxpower
2026-10-13 09:07:16
(2 weeks ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 134.122.33.94 (CA/Canada/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 134.122.33.94 - - [13/Oct/2026:11:07:10 +0200] "POST /vendor/phpunit/phpuni ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 134.122.33.94 (CA/Canada/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 134.122.33.94 - - [13/Oct/2026:11:07:10 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 200 4839 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" host=www.s2servizi.com
show less
Port Scan
2026-10-13 08:59:11
(2 weeks ago)
PSCSERV WPSCAN 134.122.33.94
Bad Web Bot
Web App Attack
2026-10-13 08:57:18
(2 weeks ago)
Blocked by siteaihub.com: auto: matched exact:/.env
Hacking
Bad Web Bot
🇵🇱
gandaflux
2026-10-13 08:55:33
(2 weeks ago)
134.122.33.94 [redacted-domain] - [13/Oct/2026:10:55:28 +0200] "GET /.env HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
134.122.33.94 [redacted-domain] - [13/Oc ...
show more
134.122.33.94 [redacted-domain] - [13/Oct/2026:10:55:28 +0200] "GET /.env HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
134.122.33.94 [redacted-domain] - [13/Oct/2026:10:55:28 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
134.122.33.94 [redacted-domain] - [13/Oct/2026:10:55:28 +0200] "GET /.git/config HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Web App Attack
