🇳🇱
homeshowdomain.nl
2026-11-13 22:59:52
UTC ·
(5 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
2026-11-13 18:28:12
UTC ·
(9 hours ago)
Bot / seems abusive / Apache connections: 33
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-13 17:34:37
UTC ·
(10 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇷🇴
clauss
2026-11-13 17:21:41
UTC ·
(11 hours ago)
34.154.207.2 - - [13/Nov/2026:19:21:40 +0200] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.154.207.2 - - [13/Nov/2026:19:21:40 +0200] ...
show more
34.154.207.2 - - [13/Nov/2026:19:21:40 +0200] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.154.207.2 - - [13/Nov/2026:19:21:40 +0200] "GET /.env.local HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇧🇷
ICS Labs
2026-11-13 16:48:44
UTC ·
(11 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-13 UTC.
Brute-Force
🇿🇦
conure.sh
2026-11-13 16:17:51
UTC ·
(12 hours ago)
csagent: score 19.9: secrets grab x2; 2 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 16:07:50
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:07:47.657729 2026] [security2:error] [pid 22102:tid 22 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:07:47.657729 2026] [security2:error] [pid 22102:tid 22102] [client 34.154.207.2:45020] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.reelfaithpodcast.com"] [uri "/.git/config"] [unique_id "avc106zcxb1Wlr5TkW2otQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-13 13:50:07
UTC ·
(14 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-13 13:24:38
UTC ·
(14 hours ago)
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 10 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safa ...
show more
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 10 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
Requested, e.g.:
- autodiscover.[REDACTED]/.git/config
- autodiscover.[REDACTED]/phpinfo.php
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 12:49:26
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:49:19.557147 2026] [security2:error] [pid 24950:tid 24 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:49:19.557147 2026] [security2:error] [pid 24950:tid 24950] [client 34.154.207.2:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ralphrichardson.com"] [uri "/.git/config"] [unique_id "avcHTx1eniQ39-_mKhyRdAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 12:33:36
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:33:30.596516 2026] [security2:error] [pid 22942:tid 22 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:33:30.596516 2026] [security2:error] [pid 22942:tid 22942] [client 34.154.207.2:35842] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.rainwaterconstruction.net"] [uri "/.git/config"] [unique_id "avcDmtI7RWveacXddo_Z6AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
ca
2026-11-13 06:03:13
UTC ·
(22 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
Sockets-AR
2026-11-13 04:04:16
UTC ·
(1 day ago)
CrowdSec: sensitive file probing detected (crowdsecurity/http-sensitive-files) at 2026-11-13T04:04:16.079Z
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 03:59:57
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:59:53.606923 2026] [security2:error] [pid 13296:tid 13 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:59:53.606923 2026] [security2:error] [pid 13296:tid 13296] [client 34.154.207.2:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.pulleasy.com"] [uri "/.git/config"] [unique_id "avaLOfflJXrPRRRneQSKLgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:51:22
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:51:15.119348 2026] [security2:error] [pid 22304:tid 22 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.154.207.2 (2.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:51:15.119348 2026] [security2:error] [pid 22304:tid 22342] [client 34.154.207.2:47110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.priyom.us"] [uri "/.git/config"] [unique_id "avZfA0yV7VVth1qA3sOaiwAAAYY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
