🇳🇱
homeshowdomain.nl
2026-10-09 22:00:00
(16 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-08.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-09 06:11:47
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.134.162.121 (121.162.134.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.134.162.121 (121.162.134.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 02:11:43.238640 2026] [security2:error] [pid 1819:tid 1819] [client 34.134.162.121:56924] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mumawvickers.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mumawvickers.com"] [uri "/z9x8c7v6b5-debug-trigger-mumawvickers.com"] [unique_id "asiFnxQClDAanGdrJgW43AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-10-09 06:05:46
(1 day ago)
Blocked by ConnMonitor
Web App Attack
🇳🇱
Alt255
2026-10-09 06:00:30
(1 day ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.134.162.121 - - [09/Oct/2026:08:00:24 +0200] "GET /.htpasswd HTTP/2.0" 403 87 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
hero2026
2026-10-09 05:25:42
(1 day ago)
Blocked by Fail2ban
Web App Attack
🇫🇷
Catalin Negru
2026-10-09 05:19:49
(1 day ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇬🇧
openstrike.co.uk
2026-10-09 05:14:58
(1 day ago)
147 attacks on shell probes, env grabbing URLs, config grabbing URLs (type 2), VC URLs, PHP URLs, di ...
show more
147 attacks on shell probes, env grabbing URLs, config grabbing URLs (type 2), VC URLs, PHP URLs, directory traversals, password/key grabbing URLs, env grabbing URLs (type 2):
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /js../.env HTTP/1.1
GET /app-config.json HTTP/1.1
GET /.git/config HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1
GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1
show less
Hacking
Web App Attack
🇵🇱
lns.bz
2026-10-09 04:52:41
(1 day ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 04:18:40
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.134.162.121 (121.162.134.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.134.162.121 (121.162.134.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 00:18:34.981925 2026] [security2:error] [pid 22952:tid 22952] [client 34.134.162.121:57422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mroxygen.org"] [uri "/.htpasswd"] [unique_id "ashrGl5VEqjVBGPHqhitDgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-10-09 03:56:26
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)
Bad Web Bot
🇨🇦
Mediashaker
2026-10-09 03:48:47
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.134.162.121 (US/U ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.134.162.121 (US/United States/121.162.134.34.bc.googleusercontent.com)
show less
Bad Web Bot
2026-10-09 02:24:46
(1 day ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-10-09 02:20:02
(1 day ago)
suspicious request in access.log
Web App Attack
2026-10-09 02:01:02
(1 day ago)
...
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-09 01:45:26
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
