🇳🇱
WeCloudit-Anti-Abuse
2026-10-12 10:04:34
(9 minutes ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
🇳🇱
Site.eu
2026-10-12 09:59:32
(14 minutes ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
Aetherweb Ark
2026-10-12 09:58:18
(16 minutes ago)
(mod_security) mod_security (id:949110) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:949110) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇲🇾
Rizzy
2026-10-12 09:24:54
(49 minutes ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 09:15:22
(59 minutes ago)
(mod_security) mod_security (id:210730) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 05:15:18.253440 2026] [security2:error] [pid 24653:tid 24653] [client 34.141.138.174:57572] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||michaelholdengc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michaelholdengc.com"] [uri "/z9x8c7v6b5-debug-trigger-michaelholdengc.com"] [unique_id "asylJntWqm3OEhrcGsbNMAAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-12 09:02:10
(1 hour ago)
34.141.138.174 - - [12/Oct/2026:12:02:08 +0300] "GET /api/.env/public/.env HTTP/2.0" 403 146 "-" "Mo ...
show more
34.141.138.174 - - [12/Oct/2026:12:02:08 +0300] "GET /api/.env/public/.env HTTP/2.0" 403 146 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
34.141.138.174 - - [12/Oct/2026:12:02:09 +0300] "GET /@fs/app/.env?raw?? HTTP/2.0" 403 146 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
...
show less
Web App Attack
🇳🇱
e.fierstra
2026-10-12 08:52:32
(1 hour ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
daytonajrw
2026-10-12 08:48:41
(1 hour ago)
Path traversal / local file read attempts: 401 requests (GETx365, POSTx33, DELETEx3) in 7s (parallel ...
show more
Path traversal / local file read attempts: 401 requests (GETx365, POSTx33, DELETEx3) in 7s (parallel), rotating spoofed crawler User-Agents (Amazonbot, Applebot, Baiduspider, Bytespider), status 200x3, 403x210, 404x183, 429x5. Exploits attempted: CVE-2025-30208, ICEcoder RCE, CVE-2022-22963, CVE-2025-3248, CVE-2024-4577, Flowise CustomMCP RCE. Also probed: credential/secret files, code-execution exploits, CMS/admin panels. Paths incl. /user/login, /@fs/root/.aws/credentials, /@fs/home/ubuntu/.aws/credentials, /@fs/home/ec2-user/.aws/credentials, /@fs/var/run/secrets/kubernetes.io/serviceaccount/ca.crt, /@fs/proc/self/cmdline, /@fs/.env, /@fs/root/.env
show less
Web App Attack
Bad Web Bot
Hacking
🇺🇸
TPI-Abuse
2026-10-12 08:47:13
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:47:07.285097 2026] [security2:error] [pid 11085:tid 11085] [client 34.141.138.174:55324] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jen-eric.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jen-eric.com"] [uri "/z9x8c7v6b5-debug-trigger-jen-eric.com"] [unique_id "asyei5fC0H2AuW7qHSszJgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-10-12 08:40:02
(1 hour ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 08:24:00
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.141.138.174 (174.138.141.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:23:55.081805 2026] [security2:error] [pid 16648:tid 16648] [client 34.141.138.174:45340] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "globalvillagecambodia.org"] [uri "/static//home/user/.env"] [unique_id "asyZG6v45ozmquvvmvCrtwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-10-12 08:11:34
(2 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1248
Exploited Host
Web App Attack
🇫🇷
dynamix
2026-10-12 08:06:14
(2 hours ago)
Multiple WAF Violations
Web App Attack
2026-10-12 08:00:07
(2 hours ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
2026-10-12 07:55:01
(2 hours ago)
suspicious request in access.log
Web App Attack
