🇧🇪
cmbplf
2026-09-03 13:08:44
(1 hour ago)
11.746 requests from abuseipdb.com blacklisted IP (2mos1w1d)
Brute-Force
Bad Web Bot
🇩🇪
FD-IX
2026-09-03 12:04:46
(2 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
2026-09-03 07:58:47
(6 hours ago)
34.158.207.209 - - [03/Sep/2026:09:58:47 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 ...
show more
34.158.207.209 - - [03/Sep/2026:09:58:47 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Web App Attack
🇷🇴
clauss
2026-09-03 07:05:45
(7 hours ago)
34.158.207.209 - - [03/Sep/2026:10:05:45 +0300] "GET /phpinfo.php HTTP/2.0" 401 543 "-" "Mozilla/5.0 ...
show more
34.158.207.209 - - [03/Sep/2026:10:05:45 +0300] "GET /phpinfo.php HTTP/2.0" 401 543 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.207.209 - - [03/Sep/2026:10:05:45 +0300] "GET /info.php HTTP/2.0" 401 543 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇸🇪
vaia.cloud
2026-09-03 06:30:03
(8 hours ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇫🇷
✨
2026-09-03 01:52:10
(12 hours ago)
Domain : blacksheepshepton.org.uk
Rule : config
2026-09-03 01:51:05 ***hidden-privacy*** GET /.git/c ...
show more
Domain : blacksheepshepton.org.uk
Rule : config
2026-09-03 01:51:05 ***hidden-privacy*** GET /.git/config - 443 - 34.158.207.209 HTTP/1.1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 - blacksheepshepton.org.uk 404 8 0 1421 308 252 - -
show less
Hacking
SQL Injection
🇩🇪
4server
2026-09-03 01:11:25
(13 hours ago)
[ThuSep0303:11:20.9794302026][security2:error][pid2213212:tid2213350][client34.158.207.209:0]ModSecu ...
show more
[ThuSep0303:11:20.9794302026][security2:error][pid2213212:tid2213350][client34.158.207.209:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"bno.ch\"][uri\"/\"][unique_id\"apjJOPuWj1xVRAaICr5GCQAAARM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-03 00:49:26
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 20:49:22.185791 2026] [security2:error] [pid 4267:tid 4267] [client 34.158.207.209:56238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blackriverarc.org"] [uri "/.git/config"] [unique_id "apjEEqD51aOksQi2sxnFqgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 23:06:45
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:06:39.327630 2026] [security2:error] [pid 24889:tid 24889] [client 34.158.207.209:55838] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blackoakprop.com"] [uri "/.git/config"] [unique_id "apir_62EW1AWAICiepDtfwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-02 22:20:07
(16 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-02 21:52:29
(16 hours ago)
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:24 +0200] "POST / HTTP/1.1" 403 1036 "-" "Mozilla/5 ...
show more
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:24 +0200] "POST / HTTP/1.1" 403 1036 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:24 +0200] "GET /.env HTTP/1.1" 404 1011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:24 +0200] "GET /.env.local HTTP/1.1" 404 1011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:24 +0200] "GET /.env.production HTTP/1.1" 404 1011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
[site]:443 34.158.207.209 - - [02/Sep/2026:23:52:25 +0200] "GET /.env.staging HTTP/1.1" 404 1011 "-" "Mozilla/5.0 (Macintosh; Intel Ma
show less
Web App Attack
Hacking
🇺🇸
agenciahypelab.com.br
2026-09-02 21:28:59
(17 hours ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇮🇹
ciccio diddo
2026-09-02 19:07:36
(19 hours ago)
High Burst multiple 40X port:Tcp/80,443
Brute-Force
Web App Attack
🇳🇱
Mangelot Hosting
2026-09-02 14:53:07
(23 hours ago)
(modsecurity) srv104 ModSecurity 34.158.207.209 (KR/South Korea/209.207.158.34.bc.googleusercontent. ...
show more
(modsecurity) srv104 ModSecurity 34.158.207.209 (KR/South Korea/209.207.158.34.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 14:49:46
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.158.207.209 (209.207.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 10:49:41.168460 2026] [security2:error] [pid 1766:tid 1766] [client 34.158.207.209:43294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bmpproductions.com.aktkaro.com"] [uri "/.git/config"] [unique_id "apg3hTDco3hV0LUymTn_TgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack