🇩🇪
paissangroup
2026-11-08 00:53:53
UTC ·
(1 minute ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 00:49:45
UTC ·
(6 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.156.121.5 (5.121.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:49:39.604515 2026] [security2:error] [pid 12044:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.121.5 (5.121.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:49:39.604515 2026] [security2:error] [pid 12044:tid 12044] [client 34.156.121.5:51148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toxicwater.helpkccare.org"] [uri "/.aws/.env"] [unique_id "au_HI2Fcza9gSG722IHE3AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Laplus
2026-11-08 00:48:46
UTC ·
(7 minutes ago)
34.156.121.5 - - [08/Nov/2026:01:48:42 +0100] "GET /.aws/credentials.bak HTTP/1.1" 404 111549 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:42 +0100] "GET /.docker/.env HTTP/1.1" 404 111525 ...
show more
34.156.121.5 - - [08/Nov/2026:01:48:42 +0100] "GET /.aws/credentials.bak HTTP/1.1" 404 111549 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:42 +0100] "GET /.docker/.env HTTP/1.1" 404 111525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:42 +0100] "GET /.aws/credentials HTTP/1.1" 404 111537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:43 +0100] "GET /.docker/laravel/app/.env HTTP/1.1" 404 111581 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:43 +0100] "GET /.docker/config.json HTTP/1.1" 404 258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:01:48:43 +0100] "GET /.aws/config HTTP/1.1" 404 111522 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"
34.156.121.5 - - [08/Nov/2026:0
...
show less
Hacking
Web App Attack
🇨🇭
zynex
2026-11-08 00:47:02
UTC ·
(8 minutes ago)
URL Probing: /.docker/.env
Web App Attack
🇬🇧
noise.agency
2026-11-08 00:45:19
UTC ·
(10 minutes ago)
34.156.121.5 (BE/Belgium/5.121.156.34.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇫🇷
sthoyer.de
2026-11-08 00:42:39
UTC ·
(13 minutes ago)
34.156.121.5 - - [08/Nov/2026:01:42:37 +0100] "GET /.amplifyrc HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
34.156.121.5 - - [08/Nov/2026:01:42:37 +0100] "GET /.env.anthropic HTTP/2" 302 495 "-" "Mozilla/5.0 (Win ...
show more
34.156.121.5 - - [08/Nov/2026:01:42:37 +0100] "GET /.amplifyrc HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
34.156.121.5 - - [08/Nov/2026:01:42:37 +0100] "GET /.env.anthropic HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
34.156.121.5 - - [08/Nov/2026:01:42:37 +0100] "GET /.aws/.env HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Web App Attack
🇩🇪
neckaralb-admin.de
2026-11-08 00:36:52
UTC ·
(18 minutes ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
Quarks Solutions
2026-11-08 00:33:22
UTC ·
(22 minutes ago)
crowdsecurity/appsec-vpatch
Web App Attack
🇬🇧
Greg Poulson
2026-11-08 00:33:00
UTC ·
(22 minutes ago)
Our website was hit by this DDOS at a rate of 123 in 5 minutes.
DDoS Attack
Web Spam
Brute-Force
🇺🇸
TPI-Abuse
2026-11-08 00:32:09
UTC ·
(23 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.156.121.5 (5.121.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:32:05.674015 2026] [security2:error] [pid 14014:tid 14 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.121.5 (5.121.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:32:05.674015 2026] [security2:error] [pid 14014:tid 14014] [client 34.156.121.5:43632] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "russellforcongress.com"] [uri "/.aws/.env"] [unique_id "au_DBbcSdAnQIai6nwg_MAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-11-08 00:30:33
UTC ·
(25 minutes ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇸🇪
KIDOS
2026-11-08 00:30:28
UTC ·
(25 minutes ago)
CrowdSec detected malicious activity
DDoS Attack
🇫🇷
Batz
2026-11-08 00:30:22
UTC ·
(25 minutes ago)
Automated, Web, Bot, hunting, for, hidden, .env, /, AI, API, Credentials
Port Scan
Bad Web Bot
Web App Attack
🇨🇦
CentiDevOps
2026-11-08 00:30:04
UTC ·
(25 minutes ago)
Web app scan: 116 requests in 2 s across 2 domains (301/404/444). Paths: /.git/config, /.git/index, /.git/logs/HEAD (+83 more). Sample: 2026-11-08T00:30:04Z "GET /.docker/config.json" 404
Hacking
Web App Attack
🇩🇪
updown.io
2026-11-08 00:26:31
UTC ·
(29 minutes ago)
{"level":"info","ts":1794097591.3874552,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.156.121.5","remote_port":"59302","client_ip":"34.156.121.5","proto":"HTTP/2.0","method":"GET","host":"prorail-otl.status.moxio. ...
show more
{"level":"info","ts":1794097591.3874552,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.156.121.5","remote_port":"59302","client_ip":"34.156.121.5","proto":"HTTP/2.0","method":"GET","host":"prorail-otl.status.moxio.com","uri":"/sendgrid.env","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"],"Accept-Encoding":["gzip, deflate"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"prorail-otl.status.moxio.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.000055186,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1794097591.3892787,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.156.121.5","remote_port":"59302","client_ip":"34.156.121.5","proto":"HTTP/2.0","method":"GET","host":"prorail-otl.status.moxio.com","uri":"/sentry.properties","headers":{"Accept-
...
show less
DDoS Attack
Web App Attack
