🇨🇭
Zdeněk Svancar
2026-11-09 04:15:26
UTC ·
(2 hours ago)
34.143.234.206 - - [09/Nov/2026:04:15:23 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.143.234.206 - - [09/Nov/2026:04:15:23 +0000] "GET /. ...
show more
34.143.234.206 - - [09/Nov/2026:04:15:23 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.143.234.206 - - [09/Nov/2026:04:15:23 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Port Scan
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-11-09 03:37:46
UTC ·
(2 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇵🇱
Budyn
2026-11-09 02:40:03
UTC ·
(3 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: gitlab.budyn.ovh | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: gitlab.budyn.ovh | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-08 23:03:08
UTC ·
(7 hours ago)
Auto-ban: >3000 req/min op 2026-11-08
Web App Attack
SSH
Hacking
2026-11-08 21:56:51
UTC ·
(8 hours ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇺🇸
JGouin
2026-11-08 20:17:01
UTC ·
(10 hours ago)
34.143.234.206 [08/Nov/2026:15:17:01 -0500] "GET /.kube/config HTTP/1.1" 403 tarpit_triggered
...
Web App Attack
2026-11-08 19:39:26
UTC ·
(10 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.143.234.206 (SG/Singapore/206.234.143.34.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-08 18:30:04
UTC ·
(12 hours ago)
(mod_security) mod_security (id:248270) triggered by 34.143.234.206 (206.234.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:29:59.725714 2026] [security2:error] [pid 9042:tid ...
show more
(mod_security) mod_security (id:248270) triggered by 34.143.234.206 (206.234.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:29:59.725714 2026] [security2:error] [pid 9042:tid 9042] [client 34.143.234.206:4378] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||sayhellotometamodernism.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sayhellotometamodernism.com"] [uri "/"] [unique_id "avC_p2komRC3JGhgV7YS5wAAAAg"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-11-08 16:54:13
UTC ·
(13 hours ago)
20 attempts against mh-misbehave-ban on ficus
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-08 14:32:26
UTC ·
(15 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1
Exploited Host
Web App Attack
2026-11-08 14:21:08
UTC ·
(16 hours ago)
Pay by Jag firewall blocked probes for sensitive files, exploit probes, backup file probes, WordPress probes from this address against protected websites.
Hacking
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-11-08 11:59:37
UTC ·
(18 hours ago)
[SunNov0812:59:34.9827442026][security2:error][pid4094169:tid4094237][client34.143.234.206:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htac ...
show more
[SunNov0812:59:34.9827442026][security2:error][pid4094169:tid4094237][client34.143.234.206:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpfacilityservices.ch\"][uri\"/wp-config.php.bak\"][unique_id\"avBkJjxbQ0gMEcUgp0dI9wAAAIU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 11:30:23
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.143.234.206 (206.234.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:30:18.501067 2026] [security2:error] [pid 31180:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.143.234.206 (206.234.143.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 06:30:18.501067 2026] [security2:error] [pid 31180:tid 31180] [client 34.143.234.206:45234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "freerein.info"] [uri "/.git/HEAD"] [unique_id "avBdSuRk_iIdgEEVF2EeMQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-11-08 10:31:54
UTC ·
(20 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇸🇬
anotherwatcher
2026-11-08 08:17:56
UTC ·
(22 hours ago)
bad bot
Bad Web Bot
