🇩🇪
Philister11
2026-09-23 02:20:34
(1 month ago)
CrowdSec: crowdsecurity/http-probing (US/AS396982)
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-23 01:00:51
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 21:00:46.290529 2026] [security2:error] [pid 10612:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 21:00:46.290529 2026] [security2:error] [pid 10612:tid 10612] [client 34.127.28.249:46782] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cinemastation.video"] [uri "/.env.local"] [unique_id "arMkvlClcL_Xh31y9wtMZwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 18:39:48
(1 month ago)
Aggressive web scan
Web App Attack
🇩🇪
Blexyel
2026-09-22 18:23:18
(1 month ago)
34.127.28.249 - - [22/Sep/2026:20:23:18 +0200] "GET /.git/config HTTP/1.1" 404 435 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" "share.fomx.gay"
...
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-09-22 17:54:44
(1 month ago)
{"level":"info","ts":1790099679.4712794,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.127.28.249","remote_port":"47112","client_ip":"34.127.28.249","proto":"HTTP/2.0","method":"GET","host":"status.equilibrium.gay" ...
show more
{"level":"info","ts":1790099679.4712794,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.127.28.249","remote_port":"47112","client_ip":"34.127.28.249","proto":"HTTP/2.0","method":"GET","host":"status.equilibrium.gay","uri":"/dist/manifest.json","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-Dest":["document"],"Priority":["u=0, i"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Fetch-Mode":["navigate"],"Upgrade-Insecure-Requests":["1"],"X-Nextjs-Data":["1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept-Language":["en-US,en;q=0.9"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Platform
...
show less
DDoS Attack
Web App Attack
🇺🇸
Rayulcifer
2026-09-22 17:35:17
(1 month ago)
34.127.28.249 - - [22/Sep/2026:12:35:15 -0500] "GET /.env.prod HTTP/2.0" 403 234 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
...
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
2026-09-22 16:29:17
(1 month ago)
Attempted access to sensitive endpoint (/login) detected. Automated scan or unauthorized probing.
Web App Attack
🇳🇱
Site.eu
2026-09-22 16:12:11
(1 month ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
TPI-Abuse
2026-09-22 13:23:31
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:23:27.242572 2026] [security2:error] [pid 615:tid 63 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:23:27.242572 2026] [security2:error] [pid 615:tid 636] [client 34.127.28.249:38172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gemini.pe"] [uri "/@fs/app/.env"] [unique_id "arKBT8-OAFL6V8CCXBcnwAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-09-22 13:00:29
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.127.28.249 (US/United States/249.28.127.34.bc.googleusercontent.com)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 12:57:14
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:57:10.406165 2026] [security2:error] [pid 29371:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.127.28.249 (249.28.127.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:57:10.406165 2026] [security2:error] [pid 29371:tid 29371] [client 34.127.28.249:60984] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dluxe.group"] [uri "/_nuxt/../.env"] [unique_id "arJ7Jt70IX5DMFbZhHr8WQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 11:09:32
(1 month ago)
34.127.28.249 - - [22/Sep/2026:13:09:28 +0200] "GET /z9x8c7v6b5-debug-trigger-aucoff.re HTTP/1.1" 404 5655
34.127.28.249 - - [22/Sep/2026:13:09:28 +0200] "POST /api/fs/exec HTTP/1.1" 404 5655
34.127.28.249 - - [22/Sep/2026:13:09:29 +0200] "POST /api/ ...
show more
34.127.28.249 - - [22/Sep/2026:13:09:28 +0200] "GET /z9x8c7v6b5-debug-trigger-aucoff.re HTTP/1.1" 404 5655
34.127.28.249 - - [22/Sep/2026:13:09:28 +0200] "POST /api/fs/exec HTTP/1.1" 404 5655
34.127.28.249 - - [22/Sep/2026:13:09:29 +0200] "POST /api/graphql HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:29 +0200] "POST /v1/graphql HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /secrets.json HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /secrets.yml HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /credentials.json HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /service-account.json HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 618
34.127.28.249 - - [22/Sep/2026:13:09:30 +0200] "GET /key.json HTTP/1.1" 404 618
...
show less
Web Spam
Web App Attack
🇩🇪
Blexyel
2026-09-22 11:02:03
(1 month ago)
34.127.28.249 - - [22/Sep/2026:13:02:02 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
Brute-Force
Web App Attack
🇺🇸
Mundo Bueno
2026-09-22 10:48:06
(1 month ago)
[ISILIA Protection v2.3] Tentative d'accès: /static../.env [RATE LIMITED - 1800s quarantine] | Pays: US | UA: Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webma
Hacking
Web App Attack
🇮🇹
VHosting
2026-09-22 09:35:04
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
