🇩🇪
gadix
2026-06-18 13:24:59
(12 hours ago)
[18/Jun/2026:15:24:58.154968 +0200] ajPxquyl7sa1O_hOwvHQVgAAABI 104.234.32.75 54960 127.0.0.1 7081
[ ...
show more
[18/Jun/2026:15:24:58.154968 +0200] ajPxquyl7sa1O_hOwvHQVgAAABI 104.234.32.75 54960 127.0.0.1 7081
[18/Jun/2026:15:24:58.342971 +0200] ajPxquyl7sa1O_hOwvHQVwAAAA0 104.234.32.75 54970 127.0.0.1 7081
[18/Jun/2026:15:24:58.636851 +0200] ajPxquyl7sa1O_hOwvHQWAAAAAw 104.234.32.75 54980 127.0.0.1 7081
...
show less
Web App Attack
🇳🇱
Savvii
2026-06-17 01:26:06
(2 days ago)
20 attempts against mh_ha-misbehave-ban on pf221105
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
akasolutions.de
2026-05-23 04:44:33
(3 weeks ago)
(wordpress) Failed wordpress login from 104.234.32.75 (US/United States/-)
Brute-Force
🇺🇸
TPI-Abuse
2026-04-27 03:43:11
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 23:42:58.165972 2026] [security2:error] [pid 9628:tid 9628] [client 104.234.32.75:36001] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mathewsdental.com"] [uri "/.env.backup"] [unique_id "ae7bQibCMk4EgVGp8uSt7gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 03:06:42
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 23:06:23.243264 2026] [security2:error] [pid 9101:tid 9101] [client 104.234.32.75:31793] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.powerkiteforum.com"] [uri "/.env_prod"] [unique_id "ae7Sr6--W6Mf7sHPugBBQQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 01:18:50
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 21:18:43.632072 2026] [security2:error] [pid 31566:tid 31566] [client 104.234.32.75:33543] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nancyscafeandcatering.com"] [uri "/.env.example"] [unique_id "ae65c-Q4WattxO2nbKy-OAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
CrystalMaker
2026-04-27 00:24:34
(1 month ago)
PHP vulnerability scan - GET /.git/index; GET /.idea/workspace.xml; GET /phpinfo.php
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 00:14:53
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.32.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 20:14:21.723928 2026] [security2:error] [pid 14373:tid 14373] [client 104.234.32.75:24277] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.oualierealty.com"] [uri "/.env_prod"] [unique_id "ae6qXafaTjqOfie3bVTFCQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
misfit
2026-04-13 15:32:58
(2 months ago)
Web scan (5 x 404);Malicious paths: /public/config.js. Org: AS206092 F.N.S. HOLDINGS LIMITED, Chicag ...
show more
Web scan (5 x 404);Malicious paths: /public/config.js. Org: AS206092 F.N.S. HOLDINGS LIMITED, Chicago, US.
show less
Brute-Force
Web App Attack
SSH
🇺🇸
stvnrdg.me
2026-04-13 13:07:39
(2 months ago)
104.234.32.75 - - [13/Apr/2026:13:07:38 +0000] "HEAD /info.php HTTP/1.1" 404 3959 "-" "Mozilla/5.0 ( ...
show more
104.234.32.75 - - [13/Apr/2026:13:07:38 +0000] "HEAD /info.php HTTP/1.1" 404 3959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0"
...
show less
Hacking
2026-04-10 22:44:35
(2 months ago)
2026-04-10T22:44:34.464994+00:00 caddy caddy[81692]: {"level":"info","ts":1775861074.4648392,"logger ...
show more
2026-04-10T22:44:34.464994+00:00 caddy caddy[81692]: {"level":"info","ts":1775861074.4648392,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"104.234.32.75","remote_port":"54025","client_ip":"104.234.32.75","proto":"HTTP/1.1","method":"GET","host":"142.132.232.19","uri":"/.__info.php","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"],"Accept-Encoding":["*"],"Accept":["*/*"],"Connection":["keep-alive"]}},"bytes_read":0,"user_id":"","duration":0.000063762,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://142.132.232.19/.__info.php"],"Content-Type":[]}}
...
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-04-10 13:49:57
(2 months ago)
Try to access /rest/.env
Web App Attack
2026-04-09 20:49:02
(2 months ago)
Sensitive file access attempt
Hacking
2026-04-09 20:10:54
(2 months ago)
104.234.32.75 - - [09/Apr/2026:22:10:54 +0200] "GET /script/.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 ...
show more
104.234.32.75 - - [09/Apr/2026:22:10:54 +0200] "GET /script/.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36"
show less
Web App Attack
🇫🇮
ngonghillsbikers
2026-04-08 02:00:18
(2 months ago)
Date: 08/Apr/2026:04:10:29.274356 +0300 | Reported IP: 104.234.32.75 mod_security | id: 920350 95013 ...
show more
Date: 08/Apr/2026:04:10:29.274356 +0300 | Reported IP: 104.234.32.75 mod_security | id: 920350 950130 959100 980170 | US/group.my_domain/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Logs: ; ; ; ; ; Warning. Pattern match; Warning. Pattern match; Warning. Unconditional match in SecAction. [file; Access denied with code 403 (phase 4). Operator GE matched 4 at TX:blocking_outbound_anomaly_score. [file
show less
SQL Injection
Brute-Force
Bad Web Bot