🇮🇳
evicky2002
2026-08-27 06:00:33
(1 month ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇨🇭
🇨🇭 Hosting
2026-08-27 05:10:21
(1 month ago)
Automated WAF report: 175-200 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
🇺🇸
Secure Gateway®️
2026-08-26 22:00:24
(1 month ago)
Report By Secure Gateway Security Team: Unauthorized Connection Attempt
Hacking
🇺🇸
ALSCO®️
2026-08-26 22:00:24
(1 month ago)
Report By ALSCO Security Team: SQL Injection Attempt Detected
Web App Attack
🇳🇱
middelkoopcc
2026-08-26 17:50:01
(1 month ago)
2026-08-26 19:48:40 AH10244: invalid URI path (/assets../../../etc/passwd) && 2026-08-26 19:48:44 AH ...
show more
2026-08-26 19:48:40 AH10244: invalid URI path (/assets../../../etc/passwd) && 2026-08-26 19:48:44 AH10244: invalid URI path (/assets../../../.env) && 2026-08-26 19:48:57 AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ) && 104 more within 20 minutes
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 16:08:41
(1 month ago)
(mod_security) mod_security (id:211190) triggered by 34.125.92.159 (159.92.125.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:211190) triggered by 34.125.92.159 (159.92.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 12:08:35.827207 2026] [security2:error] [pid 3802:tid 3802] [client 34.125.92.159:52362] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||cwvr.org|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /download?file=../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cwvr.org"] [uri "/download"] [unique_id "ao8Pg5SCWYyQTk4DVobTQwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-26 15:25:01
(1 month ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 15:06:44
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 11:06:40.381726 2026] [security2:error] [pid 17878:tid 17878] [client 34.125.92.159:59104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.hvacmechanalysis.com"] [uri "/app/.env"] [unique_id "ao8BALxC4B1TKqV439vapAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 14:40:23
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 10:40:18.459320 2026] [security2:error] [pid 24030:tid 24030] [client 34.125.92.159:12328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "creertest.com"] [uri "/@fs/../.env"] [unique_id "ao760h_YAZOF74M5zrjQDAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-26 14:24:06
(1 month ago)
34.125.92.159 - - [26/Aug/2026:16:23:46 +0200] "GET /.env.local HTTP/1.1" 403 5559 "-" "Mozilla/5.0 ...
show more
34.125.92.159 - - [26/Aug/2026:16:23:46 +0200] "GET /.env.local HTTP/1.1" 403 5559 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0;
show less
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇳🇱
Alboweb B.V.
2026-08-26 14:11:03
(1 month ago)
Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-26 12:58:37
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.92.159 (159.92.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 08:58:30.406820 2026] [security2:error] [pid 18214:tid 18214] [client 34.125.92.159:39130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shahngalu.com"] [uri "/media../.env"] [unique_id "ao7i9pTZCIwFhjwvGYBoaQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-08-26 12:56:35
(1 month ago)
Excessive multi-domain requests
Brute-Force
2026-08-26 10:12:39
(1 month ago)
[ssd5.kdns.gr] httpd-config-scan: sites=www.mariasarigkoli.gr; logs=/var/log/httpd/domains/mariasari ...
show more
[ssd5.kdns.gr] httpd-config-scan: sites=www.mariasarigkoli.gr; logs=/var/log/httpd/domains/mariasarigkoli.gr.log; samples=/files../etc/passwd | /@fs/home/ec2-user/.aws/credentials?raw?? | /.aws/credentials
show less
Hacking
Web App Attack
🇫🇷
Octopuce
2026-08-26 09:17:47
(1 month ago)
Aggressive web search of vulnerable pages: /.env.local /static../.env /.env /app/.env /media../.env ...
show more
Aggressive web search of vulnerable pages: /.env.local /static../.env /.env /app/.env /media../.env ...
show less
Web App Attack
