🇩🇪
schuerholz
2026-11-04 01:53:04
UTC ·
(3 days ago)
Web application attack detected by WAF (OWASP CRS, 13 high-volume alert(s) in 24h, e.g. /.env.backup, /.env.docker, /apps/.env). Automated detection.
Web App Attack
Hacking
🇩🇪
rh24
2026-11-04 01:45:31
UTC ·
(3 days ago)
(secretscan) Secret-Scanner (env/git/ssh/credentials) from 34.139.1.210 (US/United States/210.1.139.34.bc.googleusercontent.com)
Hacking
🇩🇪
pscriptos
2026-11-04 00:37:55
UTC ·
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
FD-IX
2026-11-03 19:33:39
UTC ·
(4 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 06:11:12
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 34.139.1.210 (210.1.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:11:07.658174 2026] [security2:error] [pid 15902:tid 15 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.1.210 (210.1.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:11:07.658174 2026] [security2:error] [pid 15902:tid 15902] [client 34.139.1.210:35790] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgas.xyz"] [uri "/.git/config"] [unique_id "aul6-_ZH8dA163pcDBCoxgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
gadix
2026-11-02 20:49:50
UTC ·
(5 days ago)
[02/Nov/2026:21:49:44.838562 +0100] auj3Z8dGiU_EWCeRT4AG-AAAAIc 34.139.1.210 32888 127.0.0.1 7081
[02/Nov/2026:21:49:47.439607 +0100] auj3asdGiU_EWCeRT4AG-QAAAJM 34.139.1.210 59584 127.0.0.1 7081
[02/Nov/2026:21:49:48.665090 +0100] auj3a8dGiU_EWCeRT4 ...
show more
[02/Nov/2026:21:49:44.838562 +0100] auj3Z8dGiU_EWCeRT4AG-AAAAIc 34.139.1.210 32888 127.0.0.1 7081
[02/Nov/2026:21:49:47.439607 +0100] auj3asdGiU_EWCeRT4AG-QAAAJM 34.139.1.210 59584 127.0.0.1 7081
[02/Nov/2026:21:49:48.665090 +0100] auj3a8dGiU_EWCeRT4AG-gAAAIQ 34.139.1.210 59588 127.0.0.1 7081
...
show less
Web App Attack
2026-11-02 18:57:20
UTC ·
(5 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇷🇺
Deynekin.com
2026-11-02 15:33:35
UTC ·
(5 days ago)
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-02T18:33:35+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: ...
show more
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-02T18:33:35+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: 1d.
Sample requests/indicators:
GET /.git/config -> 404
GET /.env -> 404
GET /.env.local -> 404
GET /.env.production -> 404
No personal data included.
--
Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 15:21:46
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.139.1.210 (210.1.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:21:42.403769 2026] [security2:error] [pid 3949:tid 394 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.1.210 (210.1.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:21:42.403769 2026] [security2:error] [pid 3949:tid 3949] [client 34.139.1.210:45380] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.tranquilitybase.network"] [uri "/.git/config"] [unique_id "auiqhroquxFM4FW94n3ToAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-02 09:10:04
UTC ·
(5 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
