🇸🇬
AP
2026-10-14 16:33:40
(2 weeks ago)
[scanmy.band] Blocked by automated security check: high AbuseIPDB confidence score.
Brute-Force
Web App Attack
🇺🇸
EvilTurkey
2026-10-13 13:59:18
(2 weeks ago)
Web app attack against financial institution website.
Web App Attack
Hacking
🇫🇷
SpaceHost-Server
2026-10-12 22:15:04
(2 weeks ago)
Brute-Force
Web App Attack
🇧🇷
radardatelecom
2026-10-11 22:28:02
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-11 22:14:49
(2 weeks ago)
Brute-Force
Web App Attack
🇺🇸
peaceharbor
2026-10-11 11:35:05
(2 weeks ago)
Swatter: score=90 intel=abuseipdb:confidence50(50) rule=critical_badpath recidivism=4/30d crit-single
Web App Attack
Port Scan
🇦🇲
arm osint
2026-10-11 04:55:38
(2 weeks ago)
Automated web vulnerability scanning: 227 HTTP 4xx probes for sensitive paths (/%2Fadmin, /%2Fapi/config, /%2Fdashboard, /%2eenv). Detected by Wazuh HIDS rule 31151 on a self-hosted web server.
Web App Attack
Brute-Force
🇿🇦
conure.sh
2026-10-11 02:43:27
(2 weeks ago)
csagent: score 19.9: secrets grab x2; 1 domain(s) in 4s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 02:08:14
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.109.176.89 (89.176.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:08:07.201727 2026] [security2:error] [pid 31770:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.176.89 (89.176.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:08:07.201727 2026] [security2:error] [pid 31770:tid 31770] [client 136.109.176.89:54330] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thesilverlegion.org"] [uri "/dist../.env"] [unique_id "asrvhw-I6KVn1zLMc0poOgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-11 02:01:08
(2 weeks ago)
Blocked by ModSec and CSF
Port Scan
🇩🇪
macrob
2026-10-11 01:45:07
(2 weeks ago)
2026/10/11 01:45:05 [error] 2248587#2248587: *38674600 access forbidden by rule, client: 136.109.176.89, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "cpanel.pitup.org"
2026/10/11 01:45:05 [error] 2248586#2248586: *3 ...
show more
2026/10/11 01:45:05 [error] 2248587#2248587: *38674600 access forbidden by rule, client: 136.109.176.89, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "cpanel.pitup.org"
2026/10/11 01:45:05 [error] 2248586#2248586: *38674611 access forbidden by rule, client: 136.109.176.89, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "cpanel.pitup.org"
2026/10/11 01:45:05 [error] 2248586#2248586: *38674612 access forbidden by rule, client: 136.109.176.89, server: fn.binixo.es, request: "GET /build../.env HTTP/2.0", host: "cpanel.pitup.org"
...
show less
Web App Attack
🇺🇸
Starburst SysOp Team
2026-10-11 01:32:53
(2 weeks ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX: ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-stl2-14)
show less
Bad Web Bot
2026-10-11 00:50:08
(2 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
WPJoe
2026-10-10 23:35:53
(2 weeks ago)
136.109.176.89 - - [10/Oct/2026:23:35:53 +0000] "GET /web/.env HTTP/1.1" 403 410 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.109.176.89 - - [10/Oct/2026:23:35:53 +0000] "GET /core/.env HTTP/1.1" 40 ...
show more
136.109.176.89 - - [10/Oct/2026:23:35:53 +0000] "GET /web/.env HTTP/1.1" 403 410 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.109.176.89 - - [10/Oct/2026:23:35:53 +0000] "GET /core/.env HTTP/1.1" 403 410 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-10 21:27:04
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.109.176.89 (89.176.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 17:27:01.216210 2026] [security2:error] [pid 19215:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.176.89 (89.176.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 17:27:01.216210 2026] [security2:error] [pid 19215:tid 19215] [client 136.109.176.89:47298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vekk.org"] [uri "/userfiles"] [unique_id "asqtpUSR0G9WRX9moquwwwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
