🇩🇪
0x44
2026-10-17 03:32:14
(1 week ago)
Abusive host detected - Attempt to access sensitive files
Web App Attack
Hacking
2026-10-17 02:49:41
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-17 02:10:21
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 22:10:16.020520 2026] [security2:error] [pid 25798:tid 25798] [client 34.154.166.113:34946] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.twccsolutions.com"] [uri "/.git/config"] [unique_id "atLZCCrA_gybNInoh5twjQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 22:56:27
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:56:22.315133 2026] [security2:error] [pid 27317:tid 27437] [client 34.154.166.113:43724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.transiit.org"] [uri "/.git/config"] [unique_id "atKrljTewHJRiYe54xxNRgAAAQc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-16 22:08:19
(1 week ago)
[SatOct1700:08:17.9978622026][security2:error][pid1724389:tid1724504][client34.154.166.113:0]ModSecu ...
show more
[SatOct1700:08:17.9978622026][security2:error][pid1724389:tid1724504][client34.154.166.113:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autodiscover.tpgs.ch\"][uri\"/\"][unique_id\"atKgUREY7ZcpwtRENDpn0gAAAQs\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-16 22:01:28
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-15.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-16 21:03:11
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:03:06.881397 2026] [security2:error] [pid 15825:tid 15825] [client 34.154.166.113:36860] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.tonynvn.me"] [uri "/.git/config"] [unique_id "atKRCp0Ctz3LqlwciqkQGAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
tmiland
2026-10-16 20:01:50
(1 week ago)
(nginx_404) Dot directory Honeypot Trap 34.154.166.113 (IT/Italy/113.166.154.34.bc.googleusercontent ...
show more
(nginx_404) Dot directory Honeypot Trap 34.154.166.113 (IT/Italy/113.166.154.34.bc.googleusercontent.com): 2 in the last 3600 secs; IP: 34.154.166.113; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.154.166.113 - - [16/Oct/2026:22:01:45 +0200] "GET /.git/config HTTP/1.1" 404 12059 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.154.166.113 - - [16/Oct/2026:22:01:48 +0200] "GET /.env HTTP/1.1" 404 12059 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-16 16:00:34
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 12:00:26.342219 2026] [security2:error] [pid 16878:tid 16878] [client 34.154.166.113:59982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.therealseska.com"] [uri "/.git/config"] [unique_id "atJKGrMGe877RDl_KU6qBgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-10-16 12:55:24
(1 week ago)
34.154.166.113 - - [16/Oct/2026:14:55:23 +0200] "GET /.git/config HTTP/1.1" 404 120 "-" "Mozilla/5.0 ...
show more
34.154.166.113 - - [16/Oct/2026:14:55:23 +0200] "GET /.git/config HTTP/1.1" 404 120 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 12:46:55
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 08:46:52.004508 2026] [security2:error] [pid 18026:tid 18026] [client 34.154.166.113:54734] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.thebestac.com"] [uri "/.git/config"] [unique_id "atIcvPF9cK409V-CFHE4FwAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 12:25:43
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.166.113 (113.166.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 08:25:36.439444 2026] [security2:error] [pid 25465:tid 25465] [client 34.154.166.113:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.theabstractpress.com"] [uri "/.git/config"] [unique_id "atIXwNcomeCcfajv50mkGAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
phoenix1jl96
2026-10-16 11:17:44
(1 week ago)
2026/10/16 13:17:43 [error] 5458#5458: *22636 open() "/home/user-data/www/default/mailer/.env" faile ...
show more
2026/10/16 13:17:43 [error] 5458#5458: *22636 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.154.166.113, server: autodiscover.test.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "autodiscover.test.ledemon.us"
2026/10/16 13:17:43 [error] 5458#5458: *22636 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.154.166.113, server: autodiscover.test.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "autodiscover.test.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇫🇷
Catalin Negru
2026-10-16 07:59:55
(1 week ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-16 05:56:59
(1 week ago)
[Thu Oct 15 23:56:56.541253 2026] [authz_core:error] [pid 141741:tid 139745267013184] [client 34.154 ...
show more
[Thu Oct 15 23:56:56.541253 2026] [authz_core:error] [pid 141741:tid 139745267013184] [client 34.154.166.113:50870] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Thu Oct 15 23:56:58.865226 2026] [authz_core:error] [pid 141741:tid 139746105857600] [client 34.154.166.113:50870] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Thu Oct 15 23:56:58.993361 2026] [authz_core:error] [pid 141741:tid 139746139428416] [client 34.154.166.113:50870] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot