🇺🇸
ALSCO®️
2026-11-06 22:00:32
UTC ·
(2 days ago)
Report By ALSCO Security Team: Unauthorized Connection Attempt
SQL Injection
🇳🇱
Alt255
2026-11-06 09:45:59
UTC ·
(3 days ago)
[ti-hoogstraov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.136.147.95 - - \[06/Nov/2026:10:45:46 +0100\] "GET /uploads../.env HTTP/1.1" 404 2121 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; ...
show more
[ti-hoogstraov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.136.147.95 - - \[06/Nov/2026:10:45:46 +0100\] "GET /uploads../.env HTTP/1.1" 404 2121 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; compatible\; ClaudeBot/1.0\; [email protected] \)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
bazter.pro
2026-11-06 06:06:32
UTC ·
(3 days ago)
Fail2Ban: plesk-bot-aggressive - 15 failures
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 05:29:08
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.136.147.95 (95.147.136.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:29:00.931851 2026] [security2:error] [pid 13620:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.136.147.95 (95.147.136.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:29:00.931851 2026] [security2:error] [pid 13620:tid 13620] [client 34.136.147.95:47666] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.venture-outsource.com"] [uri "/api/.env.bak"] [unique_id "au1lnDv1VZEMeHD_qW_RegAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-11-06 05:25:31
UTC ·
(3 days ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.136.147.95 (US/United States/95.147.136.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.136.147.95 - - [06/Nov/2026: ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.136.147.95 (US/United States/95.147.136.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.136.147.95 - - [06/Nov/2026:06:25:28 +0100] "GET /.docker/secrets.json HTTP/2.0" 429 41 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" "192.168.126.210" host=mail.yogiraji.it
show less
Port Scan
🇬🇧
consul.to
2026-11-06 04:21:17
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇹🇷
Jova
2026-11-06 04:17:18
UTC ·
(3 days ago)
Requests impersonating 3 different crawlers from one IP.
Bad Web Bot
🇳🇱
Site.eu
2026-11-06 04:17:17
UTC ·
(3 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-06 03:59:17
UTC ·
(3 days ago)
Scanning for web/db/file exploits on www.joyceoptiek.nl
SQL Injection
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-11-06 02:38:11
UTC ·
(3 days ago)
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /assets../.env HTTP/2.0" 403 16287 "https://api.temporada-alta.com/assets../.env" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /file ...
show more
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /assets../.env HTTP/2.0" 403 16287 "https://api.temporada-alta.com/assets../.env" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /files../.env HTTP/2.0" 403 16288 "https://api.temporada-alta.com/files../.env" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /uploads../.env HTTP/2.0" 403 16287 "https://api.temporada-alta.com/uploads../.env" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /css../.env HTTP/2.0" 403 16287 "https://api.temporada-alta.com/css../.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
34.136.147.95 - - [06/Nov/2026:02:37:28 +0000] "GET /public../.env HTTP/2.0" 403 16286 "https://api.temporada-alta.com/public../.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gec
...
show less
Web App Attack
🇩🇪
maxpower
2026-11-06 02:35:30
UTC ·
(3 days ago)
(PERMBLOCK) 34.136.147.95 (US/United States/95.147.136.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
Port Scan
🇯🇵
VXG-NET
2026-11-06 02:18:44
UTC ·
(3 days ago)
port=80, indicator_type=info-leak
Hacking
🇬🇧
andypiper
2026-11-06 02:01:22
UTC ·
(3 days ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
Philister11
2026-11-06 01:54:24
UTC ·
(3 days ago)
CrowdSec: crowdsecurity/http-sensitive-files (US/AS396982)
Web App Attack
Hacking
🇩🇪
4server
2026-11-06 01:49:08
UTC ·
(3 days ago)
[FriNov0602:49:03.5617082026][security2:error][pid657005:tid657197][client34.136.147.95:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLO ...
show more
[FriNov0602:49:03.5617082026][security2:error][pid657005:tid657197][client34.136.147.95:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.restaurantgandria.ch\"][uri\"/.aws/credentials\?.txt\"][unique_id\"au0yDwrfNYEGrivdT2GPiwAAAEc\"]
show less
Port Scan
Brute-Force
Web App Attack
