🇪🇸
bohl-aiG5aef
2026-10-21 05:45:03
(1 week ago)
Suricata Alert [SID:2066030] ET HUNTING Javascript Sandbox Escape via Global Object (process)
Hacking
2026-10-21 01:10:34
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
Matthew Ping
2026-10-21 00:45:02
(1 week ago)
Excessive connections (DDoS/flood) blocked by CSF CT_LIMIT on dedicated4785.
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-21 00:17:19
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.158.92.205 (205.92.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 20:17:12.196090 2026] [security2:error] [pid 19924:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.158.92.205 (205.92.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 20:17:12.196090 2026] [security2:error] [pid 19924:tid 19924] [client 34.158.92.205:35708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.produktives.com"] [uri "/uploads../.env"] [unique_id "atgEiI5S8I7_997WZSalyQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-20 23:35:59
(1 week ago)
{"level":"info","ts":1792539358.6840534,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.92.205","remote_port":"53680","client_ip":"34.158.92.205","proto":"HTTP/2.0","method":"GET","host":"status.questioncove.com ...
show more
{"level":"info","ts":1792539358.6840534,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.92.205","remote_port":"53680","client_ip":"34.158.92.205","proto":"HTTP/2.0","method":"GET","host":"status.questioncove.com","uri":"/asset-manifest.json","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Sec-Fetch-User":["?1"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Mode":["navigate"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Language":["en-US,en;q=0.9"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-Dest":["document"],"Accept":["text/html,application/xhtml+xml,
...
show less
DDoS Attack
Web App Attack
🇳🇱
0xffffffff
2026-10-20 19:41:16
(1 week ago)
[2026-10-20 22:41:14.447426] [authz_core:error] [pid 1144350:tid 138210994362048] [client 34.158.92.205:57288] AH01630: client denied by server configuration: /var/www/*/lib , error_notes:missing-php , URI:'/lib/terminal-xhr.php'
[2026-10-20 22:41:14 ...
show more
[2026-10-20 22:41:14.447426] [authz_core:error] [pid 1144350:tid 138210994362048] [client 34.158.92.205:57288] AH01630: client denied by server configuration: /var/www/*/lib , error_notes:missing-php , URI:'/lib/terminal-xhr.php'
[2026-10-20 22:41:14.449907] [authz_core:error] [pid 1144350:tid 138210859890368] [client 34.158.92.205:57288] AH01630: client denied by server configuration: /var/www/*/z9x8c7v6b5-debug-trigger-dev.* , error_notes:debug-probing , URI:'/z9x8c7v6b5-debug-trigger-dev.*'
[2026-10-20 22:41:14.449907] [authz_core:error] [pid 1144350:tid 138210859890368] [client 34.158.92.205:57288] AH01630: client denied by server configuration: /var/www/*/z9x8c7v6b5-debug-trigger-dev.* , error_notes:debug-probing , URI:'/z9x8c7v6b5-debug-trigger-dev.*'
[2026-10-20 22:41:14.453529] [authz_core:error] [pid 1144350:tid 138210960791232] [client 34.158.92.205:57288] AH01630: client denied by server configuration: /var/www/*/dist , error_notes:config-files , URI:'/dist/.vite/manifest.json'
[2026-10-20 22:41:14
show less
Web App Attack
Bad Web Bot
🇨🇦
SSH-Admin
2026-10-20 19:00:16
(1 week ago)
Probing for Exploits on ns200
Exploited Host
Web App Attack
2026-10-20 17:30:53
(1 week ago)
Aggressive web scan
Web App Attack
🇺🇸
jormaster3k
2026-10-20 17:23:57
(1 week ago)
Attack against Apache (too many 404s)
Web App Attack
2026-10-20 16:52:25
(1 week ago)
Blocked by ModSec and CSF
Port Scan
🇷🇴
gtheo99
2026-10-20 16:50:06
(1 week ago)
(CT) IP 34.158.92.205 (NL/The Netherlands/205.92.158.34.bc.googleusercontent.com) found to have 113 connections
Port Scan
🇹🇷
Jova
2026-10-20 16:39:31
(1 week ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇨🇦
SSH-Admin
2026-10-20 16:37:02
(1 week ago)
Probing for Exploits on ns210
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 16:34:53
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.158.92.205 (205.92.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 12:34:46.527916 2026] [security2:error] [pid 32477:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 34.158.92.205 (205.92.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 12:34:46.527916 2026] [security2:error] [pid 32477:tid 32477] [client 34.158.92.205:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pulleasy.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pulleasy.com"] [uri "/z9x8c7v6b5-debug-trigger-pulleasy.com"] [unique_id "ateYJmLMt9rBKb_5Dv5xggAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
0xffffffff
2026-10-20 16:25:21
(1 week ago)
[2026-10-20 19:25:18.968316] [authz_core:error] [pid 1144352:tid 138210868299456] [client 34.158.92.205:0] AH01630: client denied by server configuration: /var/www/*/lib , error_notes:missing-php , URI:'/lib/terminal-xhr.php'
[2026-10-20 19:25:18.992 ...
show more
[2026-10-20 19:25:18.968316] [authz_core:error] [pid 1144352:tid 138210868299456] [client 34.158.92.205:0] AH01630: client denied by server configuration: /var/www/*/lib , error_notes:missing-php , URI:'/lib/terminal-xhr.php'
[2026-10-20 19:25:18.992207] [authz_core:error] [pid 1144352:tid 138210859890368] [client 34.158.92.205:0] AH01630: client denied by server configuration: /var/www/*/z9x8c7v6b5-debug-trigger-* , error_notes:debug-probing , URI:'/z9x8c7v6b5-debug-trigger-*'
[2026-10-20 19:25:19.077889] [authz_core:error] [pid 1144352:tid 138210901935808] [client 34.158.92.205:0] AH01630: client denied by server configuration: /var/www/*/.vite , error_notes:config-files , URI:'/.vite/manifest.json'
[2026-10-20 19:25:19.078289] [authz_core:error] [pid 1144352:tid 138210851481280] [client 34.158.92.205:0] AH01630: client denied by server configuration: /var/www/*/icecoder , error_notes:missing-php , URI:'/icecoder/lib/terminal-xhr.php'
[2026-10-20 19:25:19.082724] [authz_core:error] [pid 1144352:tid 13821093
show less
Web App Attack
Bad Web Bot
