🇳🇱
Site.eu
2026-09-29 16:23:10
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
4server
2026-09-29 15:00:25
(1 month ago)
[TueSep2917:00:20.8648912026][security2:error][pid2427999:tid2428119][client34.104.170.247:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htac ...
show more
[TueSep2917:00:20.8648912026][security2:error][pid2427999:tid2428119][client34.104.170.247:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.eimeko.ch.136-243-54-122.cpanel.site\"][uri\"/.env.bak\"][unique_id\"arvShHWiM9bebJfwpjyztAAAAQk\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 05:03:40
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 01:03:35.311232 2026] [security2:error] [pid 5862:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 01:03:35.311232 2026] [security2:error] [pid 5862:tid 5862] [client 34.104.170.247:60698] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.badfoodlawsuit.com.helpkccare.org"] [uri "/.git/config"] [unique_id "artGpwMtmxXONg505TjUsgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-09-28 21:49:41
(1 month ago)
[Tue Sep 29 07:49:40.450619 2026] [security2:error] [pid 164036] [client 34.104.170.247:32980] [client 34.104.170.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/RE ...
show more
[Tue Sep 29 07:49:40.450619 2026] [security2:error] [pid 164036] [client 34.104.170.247:32980] [client 34.104.170.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/.git/config"] [unique_id "arrg9HpwdSl7298Q4I8gGQAAAAc"]
...
show less
Web App Attack
🇩🇪
big-cloud.nl
2026-09-28 11:05:54
(1 month ago)
Try to access /.git/config
Web App Attack
🇳🇱
Site.eu
2026-09-28 06:14:12
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
Grossmann-Gruppe
2026-09-28 04:13:35
(1 month ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇳🇱
e.fierstra
2026-09-27 16:24:14
(1 month ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-27 00:07:42
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 20:24:10
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 16:24:06.572370 2026] [security2:error] [pid 25249:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 16:24:06.572370 2026] [security2:error] [pid 25249:tid 25249] [client 34.104.170.247:39134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.dailybeautysupply.com"] [uri "/.git/config"] [unique_id "argp5hyh1L7laC20-Obe3gAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-26 15:53:12
(1 month ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇫🇷
dynamix
2026-09-26 15:00:35
(1 month ago)
Multiple WAF Violations
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-26 12:31:31
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-25 08:50:06
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 04:50:00.448983 2026] [security2:error] [pid 29968:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.170.247 (247.170.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 04:50:00.448983 2026] [security2:error] [pid 29968:tid 30054] [client 34.104.170.247:37854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.charteredeconomist.aafm.us"] [uri "/.git/config"] [unique_id "arY1uGR0612jdjGZSN2MbAAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-25 07:43:26
(1 month ago)
csagent: score 19.9: secrets grab x2; 1 domain(s) in 3s
Web App Attack
