🇵🇱
nakordoni.eu
2026-11-10 13:43:03
UTC ·
(7 hours ago)
Blocked by nakordoni.eu automated security: nakordoni-probe-gate. Jail: nakordoni-probe-gate, 1 matches. ISP: Google LLC (US), Usage: Data Center/Web Hosting/Transit. Prior AbuseIPDB score at ban time: 100/100.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 13:27:51
UTC ·
(8 hours ago)
(mod_security) mod_security (id:248270) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:27:43.122492 2026] [security2:error] [pid 5525:tid 5 ...
show more
(mod_security) mod_security (id:248270) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:27:43.122492 2026] [security2:error] [pid 5525:tid 5525] [client 136.85.130.13:58168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||flightsimulationinc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "flightsimulationinc.com"] [uri "/"] [unique_id "avMbzwi9JBzFuXvBWQSrhgAAACU"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-11-10 13:21:45
UTC ·
(8 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:13:37
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:13:34.063256 2026] [security2:error] [pid 7400:tid 7 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:13:34.063256 2026] [security2:error] [pid 7400:tid 7400] [client 136.85.130.13:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.coiledtubingdrilling.com"] [uri "/.env.dev"] [unique_id "avL8XpL53jh4gQXydtRBdgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-11-10 10:05:14
UTC ·
(11 hours ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-11-10 09:47:45
UTC ·
(11 hours ago)
csagent: score 19.8: secrets grab x2; 1 domain(s) in 8s
Web App Attack
🇺🇸
pixiekat
2026-11-10 09:26:03
UTC ·
(12 hours ago)
Banned by fail2ban (modsec-tripwire, 1 hits) [msg "no source code for you"]
Bad Web Bot
Web App Attack
🇳🇱
ams_sec_user
2026-11-10 09:05:17
UTC ·
(12 hours ago)
Automated requests against a hosted website: 446 requests between 08:00 and 08:59 UTC; 243 probes for exposed secrets/config files (/.git/HEAD, /.env.development, /.env.staging). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:58:51
UTC ·
(12 hours ago)
(mod_security) mod_security (id:248270) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:58:45.374895 2026] [security2:error] [pid 25741:tid ...
show more
(mod_security) mod_security (id:248270) triggered by 136.85.130.13 (13.130.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:58:45.374895 2026] [security2:error] [pid 25741:tid 25741] [client 136.85.130.13:52818] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||techdds.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "techdds.com"] [uri "/"] [unique_id "avLcxTrconTsKX2kg56HowAAAAk"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
boxed-it
2026-11-10 03:04:46
UTC ·
(18 hours ago)
GET /.env.stage (Tarpitted for 6s, wasted 480B)
Web App Attack
🇬🇧
consul.to
2026-11-10 02:51:12
UTC ·
(18 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
Roderic
2026-11-10 02:44:53
UTC ·
(18 hours ago)
Insights: 6 probe requests within 24 hours on 1 site, e.g. /wp-config.php.save (no normal page views)
Web App Attack
🇳🇱
e.fierstra
2026-11-10 01:58:02
UTC ·
(19 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-10 00:21:05
UTC ·
(21 hours ago)
157 requests with url.path *config.json
127 requests with url.path *.svn/*
116 requests with url.path *.hg/*
108 requests with url.path *.aws/*
Brute-Force
Bad Web Bot
🇵🇱
Budyn
2026-11-10 00:12:07
UTC ·
(21 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: elastic.goblinpot.space | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: elastic.goblinpot.space | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
