🇳🇱
homeshowdomain.nl
2026-09-30 22:00:31
UTC ·
(1 month ago)
Auto-ban: >3000 req/min op 2026-09-30
Web App Attack
SSH
Hacking
2026-09-30 13:45:16
UTC ·
(1 month ago)
Observed scanned 55 known-sensitive endpoint(s), e.g.: /.//.env, /.env, /.env.bak, /.env.local, /.git/config, /.github/workflows/deploy.yml
Bad Web Bot
Web App Attack
🇺🇸
Epimetheus
2026-09-30 03:50:28
UTC ·
(1 month ago)
Zombie network / Bot scanner detected:
[POST] /langflow/api/v1/validate/code
[GET] /dashboard%2F.env
[GET] /portal/.env
[GET] /llm/.env
[GET] /aws-config.js
[GET] /app_dev.php
[GET] /src/amplifyconfiguration.json
[GET] /dev/.env
[GET] /bot/.env
[GET ...
show more
Zombie network / Bot scanner detected:
[POST] /langflow/api/v1/validate/code
[GET] /dashboard%2F.env
[GET] /portal/.env
[GET] /llm/.env
[GET] /aws-config.js
[GET] /app_dev.php
[GET] /src/amplifyconfiguration.json
[GET] /dev/.env
[GET] /bot/.env
[GET] /agents/.env
[POST] /api/graphql
[GET] /_nuxt/../.env
[GET] /@fs/home/ec2-user/.aws/credentials
[GET] /userfiles/x
[GET] /credentials.js
[GET] /.env.swp
[GET] /wp-config.php.bak
[GET] /api/v1/settings
[GET] /pages/index.astro.mjs.map
UA: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)
show less
Bad Web Bot
Exploited Host
Web App Attack
🇩🇪
Bedios GmbH
2026-09-30 02:53:41
UTC ·
(1 month ago)
Wordpress hacking attempt
Web App Attack
🇧🇪
cmbplf
2026-09-30 00:05:53
UTC ·
(1 month ago)
3.724 requests from abuseipdb.com blacklisted IP (1yr5mos5d)
Brute-Force
Bad Web Bot
🇳🇱
mieg
2026-09-29 23:55:23
UTC ·
(1 month ago)
Web vulnerability probing
Brute-Force
Web App Attack
🇩🇪
Hazzard
2026-09-29 23:36:34
UTC ·
(1 month ago)
(PERMBLOCK) 104.196.154.123 (US/United States/South Carolina/North Charleston/123.154.196.104.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
Hacking
🇺🇸
TPI-Abuse
2026-09-29 23:12:12
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 104.196.154.123 (123.154.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:12:08.148000 2026] [security2:error] [pid 17573: ...
show more
(mod_security) mod_security (id:210730) triggered by 104.196.154.123 (123.154.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:12:08.148000 2026] [security2:error] [pid 17573:tid 17591] [client 104.196.154.123:54182] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||evan-hotel.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "evan-hotel.com"] [uri "/z9x8c7v6b5-debug-trigger-evan-hotel.com"] [unique_id "arxFyFfug8SxE73HcvKregAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 22:49:23
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 104.196.154.123 (123.154.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 18:49:19.624126 2026] [security2:error] [pid 27648: ...
show more
(mod_security) mod_security (id:949110) triggered by 104.196.154.123 (123.154.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 18:49:19.624126 2026] [security2:error] [pid 27648:tid 27648] [client 104.196.154.123:51880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "cescfoundation.org"] [uri "/.env"] [unique_id "arxAbytfCsrRUvXJp7hxIQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
radardatelecom
2026-09-29 22:26:03
UTC ·
(1 month ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇧🇷
dominioz
2026-09-29 22:04:00
UTC ·
(1 month ago)
2026-09-29 22:03:55 GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env raw?? - 104.196.154.123 HTTP/2 Mozilla/5.0+(compatible;+KimiBot/1.0;++https://kimi.ai/) - 301 638
...
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-29 22:00:42
UTC ·
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
dtorrer
2026-09-29 22:00:36
UTC ·
(1 month ago)
General vulnerability scan.
Port Scan
🇩🇪
updown.io
2026-09-29 21:07:37
UTC ·
(1 month ago)
{"level":"info","ts":1790716054.1818464,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.196.154.123","remote_port":"39014","client_ip":"104.196.154.123","proto":"HTTP/2.0","method":"POST","host":"dx7x.status.updown ...
show more
{"level":"info","ts":1790716054.1818464,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.196.154.123","remote_port":"39014","client_ip":"104.196.154.123","proto":"HTTP/2.0","method":"POST","host":"dx7x.status.updown.io","uri":"/graphql","headers":{"Sec-Fetch-Mode":["cors"],"Referer":["https://dx7x.status.updown.io"],"Sec-Ch-Ua-Platform":["\"macOS\""],"Accept-Encoding":["gzip, deflate, br, zstd"],"Origin":["https://dx7x.status.updown.io"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Google Chrome\";v=\"152\""],"Sec-Ch-Ua-Mobile":["?0"],"Content-Type":["application/json"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["*/*"],"Cookie":["REDACTED"],"Content-Length":["86"],"Sec-Fetch-Site":["same-origin"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Fetch-Dest":["empty"],"Priority":["u=1, i"]},"tls":{"resumed":false,"version":772,"cipher_suit
...
show less
DDoS Attack
Web App Attack
2026-09-29 21:07:06
UTC ·
(1 month ago)
Automated web scanner. Requested suspicious paths: /.vite/manifest.json | /build/manifest.json | /dist/manifest.json | /z9x8c7v6b5-debug-trigger-tools.tigzig.com | /dist/.vite/manifest.json. UTC: 2026-09-29 21:03:17.
Web App Attack
