🇺🇸
TPI-Abuse
2026-09-21 03:55:55
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:55:48.200477 2026] [security2:error] [pid 29728:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:55:48.200477 2026] [security2:error] [pid 29728:tid 29810] [client 104.199.249.74:35398] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thebiglies.info"] [uri "/.git/config"] [unique_id "arCqxFZC6IbGi0TetZq1BgAAAcg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:34:02
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:33:56.093740 2026] [security2:error] [pid 12937:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:33:56.093740 2026] [security2:error] [pid 12937:tid 12937] [client 104.199.249.74:58712] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sangalgano.info"] [uri "/@fs/app/.env"] [unique_id "arClpNh_nH5ySZxmKzEkwwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-21 02:21:53
UTC ·
(1 month ago)
Multiple WAF Violations
Web App Attack
🇩🇪
updown.io
2026-09-21 00:51:06
UTC ·
(1 month ago)
{"level":"info","ts":1789951859.5771246,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.199.249.74","remote_port":"58170","client_ip":"104.199.249.74","proto":"HTTP/2.0","method":"GET","host":"aceforbiz.pro-epic.in ...
show more
{"level":"info","ts":1789951859.5771246,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.199.249.74","remote_port":"58170","client_ip":"104.199.249.74","proto":"HTTP/2.0","method":"GET","host":"aceforbiz.pro-epic.info","uri":"/public-status?p=%2Fz9x8c7v6b5-debug-trigger-www.aceforbiz.pro-epic.info?p=%2Fz9x8c7v6b5-debug-trigger-www.aceforbiz.pro-epic.info","headers":{"Accept-Encoding":["gzip"],"Accept":["*/*"],"Referer":["https://www.aceforbiz.pro-epic.info/z9x8c7v6b5-debug-trigger-www.aceforbiz.pro-epic.info"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"aceforbiz.pro-epic.info","ech":false}},"by
...
show less
DDoS Attack
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-09-21 00:10:08
UTC ·
(1 month ago)
2026/09/21 01:10:04 [error] 325888#325888: *866674 access forbidden by rule, client: 104.199.249.74, server: api.betatechnologies.info, request: "GET /api/v1/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/09/21 01:10:06 [error] 325888#325888: ...
show more
2026/09/21 01:10:04 [error] 325888#325888: *866674 access forbidden by rule, client: 104.199.249.74, server: api.betatechnologies.info, request: "GET /api/v1/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/09/21 01:10:06 [error] 325888#325888: *866674 access forbidden by rule, client: 104.199.249.74, server: api.betatechnologies.info, request: "GET /.env HTTP/2.0", host: "api.betatechnologies.info"
104.199.249.74 - - [21/Sep/2026:01:10:06 +0100] "GET /.env HTTP/2.0" 403 95 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
show less
Brute-Force
Web App Attack
🇩🇪
Marc
2026-09-20 22:54:45
UTC ·
(1 month ago)
104.199.249.74 - - [21/Sep/2026:00:54:44 +0200] "GET /api/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 104.199.249.74 - - [21/Sep/2026:00:54:44 +0200] "GET /.aws/config HTTP/2.0" 404 269 "-" "Mozilla/ ...
show more
104.199.249.74 - - [21/Sep/2026:00:54:44 +0200] "GET /api/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 104.199.249.74 - - [21/Sep/2026:00:54:44 +0200] "GET /.aws/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" 104.199.249.74 - - [21/Sep/2026:00:54:44 +0200] "GET /api/settings HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
show less
Brute-Force
🇫🇷
Lunix
2026-09-20 22:47:15
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-09-20 21:50:04
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
2026-09-20 21:50:02
UTC ·
(1 month ago)
| [Dangerous/Taiwan] Aggressive IP 104.199.249.74 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-09-20 21:43:27
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:43:23.579830 2026] [security2:error] [pid 11459:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:43:23.579830 2026] [security2:error] [pid 11459:tid 11459] [client 104.199.249.74:50180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.freerein.info"] [uri "/.git/HEAD"] [unique_id "arBTe6YESPzCkFEiV3qVNQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-09-20 21:23:56
UTC ·
(1 month ago)
104.199.249.74 - - [20/Sep/2026:23:23:53 +0200] "GET /id_ed25519 HTTP/2.0" 404 293 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
104.199.249.74 - - [20/Sep/2026:23:23:53 +0200] "GET /a ...
show more
104.199.249.74 - - [20/Sep/2026:23:23:53 +0200] "GET /id_ed25519 HTTP/2.0" 404 293 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
104.199.249.74 - - [20/Sep/2026:23:23:53 +0200] "GET /actuator HTTP/2.0" 404 293 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
104.199.249.74 - - [20/Sep/2026:23:23:53 +0200] "GET /@fs/../.env?raw?? HTTP/2.0" 404 293 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
104.199.249.74 - - [20/Sep/2026:23:23:54 +0200] "GET /actuator/configprops HTTP/2.0" 403 319 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email])"
104.199.249.74 - - [20/Sep/2026:23:23:54 +0200] "GET /id_ecdsa HTTP/2.0" 404 293 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
104.199.249.74 - - [20/Sep/2026:23:23:54 +0200] "GET /server.key HTTP/2.0" 404 293 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
104.199.
show less
Web App Attack
Hacking
🇵🇱
TaKeN
2026-09-20 20:55:20
UTC ·
(1 month ago)
Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing from this source IP. Observed 1 matching blocked event(s) between 2026-09-20T22:55:20+02:00 and 2026-09-20T22:55:20+02:00. Sample requested path ...
show more
Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing from this source IP. Observed 1 matching blocked event(s) between 2026-09-20T22:55:20+02:00 and 2026-09-20T22:55:20+02:00. Sample requested paths: /private/.env.
show less
Web App Attack
Hacking
🇮🇹
VHosting
2026-09-20 20:35:04
UTC ·
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 20:15:51
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 16:15:47.536387 2026] [security2:error] [pid 8015:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.249.74 (74.249.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 16:15:47.536387 2026] [security2:error] [pid 8015:tid 8015] [client 104.199.249.74:57196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.finner.info"] [uri "/admin/.env"] [unique_id "arA-82OJWEQU5ofG8mflSQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 20:05:11
UTC ·
(1 month ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
