🇮🇹
madaello
2026-11-11 17:10:41
UTC ·
(2 days ago)
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /admin HTTP/1.1" 404 4451 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /.git/HEAD HTTP/1.1" 404 501 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /admin HTTP/1.1" 404 4451 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /.git/HEAD HTTP/1.1" 404 501 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /%22js/jquery-1.11.2.min.js%22 HTTP/1.1" 404 4451 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /%22js/bootstrap.min.js%22 HTTP/1.1" 404 4451 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [11/Nov/2026:18:10:40 +0100] "GET /matomo.php HTTP/1.1" 404 212 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Port Scan
🇺🇸
TPI-Abuse
2026-11-11 07:22:30
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.156.60.248 (248.60.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 02:22:22.103554 2026] [security2:error] [pid 30557:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.60.248 (248.60.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 02:22:22.103554 2026] [security2:error] [pid 30557:tid 30557] [client 34.156.60.248:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.git/HEAD"] [unique_id "avQXrhHLKa-gmGGRrDkllQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-11-11 04:36:58
UTC ·
(2 days ago)
Too many 404 requests [BY]
Web App Attack
Anonymous
2026-11-11 02:48:33
UTC ·
(2 days ago)
Web scanner: GET /.git/HEAD
Web App Attack
Hacking
🇫🇷
SpaceHost-Server
2026-11-10 23:18:52
UTC ·
(3 days ago)
Brute-Force
Web App Attack
Anonymous
2026-11-10 22:26:16
UTC ·
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇩🇰
floyd_dk
2026-11-10 17:51:03
UTC ·
(3 days ago)
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /.vault-token HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] " ...
show more
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /.vault-token HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /.aws/credentials.bak HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /config.yml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.156.60.248 - - [10/Nov/2026:17:51:03 +0000] "GET /.aws/.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537
...
show less
Web App Attack
🇩🇪
mondor.ro
2026-11-10 04:11:32
UTC ·
(3 days ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.156.60.248, Reason:[(mod_security) mod_security (id:210492) triggered by 34.156.60.248 (BE/Belgium/248.60.156.34.bc.googleusercontent.com): 3 in the last 3600 secs]; Por ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.156.60.248, Reason:[(mod_security) mod_security (id:210492) triggered by 34.156.60.248 (BE/Belgium/248.60.156.34.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇫🇷
dynamix
2026-11-10 03:49:44
UTC ·
(3 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
macrob
2026-11-10 02:37:23
UTC ·
(3 days ago)
2026/11/10 02:37:22 [error] 1367339#1367339: *22006386 access forbidden by rule, client: 34.156.60.248, server: binixo.ph, request: "GET /.git/HEAD HTTP/1.1", host: "binixo.ph"
2026/11/10 02:37:22 [error] 1367339#1367339: *22006387 access forbidden b ...
show more
2026/11/10 02:37:22 [error] 1367339#1367339: *22006386 access forbidden by rule, client: 34.156.60.248, server: binixo.ph, request: "GET /.git/HEAD HTTP/1.1", host: "binixo.ph"
2026/11/10 02:37:22 [error] 1367339#1367339: *22006387 access forbidden by rule, client: 34.156.60.248, server: binixo.ph, request: "GET /.bfrt-1794278242501816074-404 HTTP/1.1", host: "binixo.ph"
2026/11/10 02:37:22 [error] 1367335#1367335: *22006421 access forbidden by rule, client: 34.156.60.248, server: binixo.ph, request: "GET /.vite/manifest.json HTTP/1.1", host: "binixo.ph"
...
show less
Web App Attack
🇩🇪
arnisolutions
2026-11-10 00:47:47
UTC ·
(3 days ago)
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 1 day(s) between 2026-11-10 and 2026-11-10 (UTC). Additional activity: 410flood. Sample request: GET /.aws/credentials.bak HTTP/1.1
Web App Attack
Hacking
🇩🇪
netclix.gr
2026-11-09 22:20:11
UTC ·
(4 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.156.60.248 (BE/Belgium/248.60.156.34.bc.googleusercontent.com)
SQL Injection
🇳🇱
ams_sec_user
2026-11-09 22:05:24
UTC ·
(4 days ago)
Automated requests against a hosted website: 184 requests between 21:00 and 21:59 UTC; 81 probes for exposed secrets/config files (/.git/HEAD, /.git/hooks/post-checkout, /.git/hooks/update). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
Anonymous
2026-11-09 12:38:45
UTC ·
(4 days ago)
Http Port:80 (http_status:404) - Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Web App Attack
🇩🇪
raph
2026-11-09 12:38:20
UTC ·
(4 days ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack