2026-09-23 23:45:25
(1 month ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-19 20:42:01
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.142.135.144 (144.135.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 16:41:55.105505 2026] [security2:error] [pid 14323:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.142.135.144 (144.135.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 16:41:55.105505 2026] [security2:error] [pid 14323:tid 14323] [client 34.142.135.144:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.demondomain.com"] [uri "/.env.production"] [unique_id "aq7zkzR7q_tTreLUenCmfwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-09-19 19:53:53
(1 month ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
deskpass.com
2026-09-19 19:17:40
(1 month ago)
POST /icecoder/lib/terminal-xhr.php
Web App Attack
🇫🇷
regishoussin
2026-09-19 16:18:58
(1 month ago)
Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-09-19 16:18 UTC.
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-19 14:25:03
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
tall1oN
2026-09-19 14:06:23
(1 month ago)
34.142.135.144 - - [19/Sep/2026:16:06:23 +0200] "POST /graphql HTTP/2.0" 405 559 "https://cdn.demons-gaming.cc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "cdn.demons-gaming.cc"
3 ...
show more
34.142.135.144 - - [19/Sep/2026:16:06:23 +0200] "POST /graphql HTTP/2.0" 405 559 "https://cdn.demons-gaming.cc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "cdn.demons-gaming.cc"
34.142.135.144 - - [19/Sep/2026:16:06:23 +0200] "POST /api/graphql HTTP/2.0" 405 559 "https://cdn.demons-gaming.cc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "cdn.demons-gaming.cc"
...
show less
Web App Attack
Port Scan
Hacking
🇺🇸
deskpass.com
2026-09-19 01:46:16
(1 month ago)
POST /lib/terminal-xhr.php
Web App Attack
🇫🇷
dynamix
2026-09-18 23:39:00
(1 month ago)
Multiple WAF Violations
Web App Attack
🇩🇪
FD-IX
2026-09-18 17:27:01
(1 month ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
2026-09-18 13:21:28
(1 month ago)
Portscan: TCP/8443 (13x), TCP/8080 (15x), TCP/443, TCP/80
Port Scan
🇧🇷
Caue Henrique
2026-09-18 13:00:37
(1 month ago)
Multiplewebserver500errorcode
Web Spam
Web App Attack
🇳🇴
Abuse Buster
2026-09-18 07:28:42
(1 month ago)
34.142.135.144 - - [18/Sep/2026:09:28:40 +0200] "GET /rclone.conf HTTP/2.0" 404 22 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.142.135.144 - - [18/Sep/2026:09:28:40 +0200 ...
show more
34.142.135.144 - - [18/Sep/2026:09:28:40 +0200] "GET /rclone.conf HTTP/2.0" 404 22 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.142.135.144 - - [18/Sep/2026:09:28:40 +0200] "GET /.ssh/id_ecdsa HTTP/2.0" 404 22 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
34.142.135.144 - - [18/Sep/2026:09:28:40 +0200] "GET /.ssh/id_ed25519 HTTP/2.0" 404 22 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
...
show less
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-09-18 07:16:53
(1 month ago)
2026/09/18 08:16:50 [error] 325888#325888: *115747 access forbidden by rule, client: 34.142.135.144, server: [redacted], request: "GET /_nuxt/../.env HTTP/2.0", host: "smtp.gwynethllewelyn.net"
2026/09/18 08:16:51 [error] 325888#325888: *115755 acces ...
show more
2026/09/18 08:16:50 [error] 325888#325888: *115747 access forbidden by rule, client: 34.142.135.144, server: [redacted], request: "GET /_nuxt/../.env HTTP/2.0", host: "smtp.gwynethllewelyn.net"
2026/09/18 08:16:51 [error] 325888#325888: *115755 access forbidden by rule, client: 34.142.135.144, server: [redacted], request: "GET /media../.env HTTP/2.0", host: "smtp.gwynethllewelyn.net"
2026/09/18 08:16:51 [error] 325888#325888: *115758 access forbidden by rule, client: 34.142.135.144, server: [redacted], request: "GET /files../.env HTTP/2.0", host: "smtp.gwynethllewelyn.net"
show less
Brute-Force
Web App Attack
🇩🇪
Hagen Schoebel
2026-09-18 06:14:03
(1 month ago)
Blocked by CrowdSec - Enabling body inspection (SG)
Port Scan
Brute-Force
Web App Attack
SSH
