🇩🇪
Vegascosmetics
2026-10-17 09:13:42
(3 hours ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after matched multi-pattern attack signatur ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after matched multi-pattern attack signature. Evidence: AttackPattern: /\.vite/ (Match: /.vite/)
show less
Hacking
Web App Attack
🇩🇪
updown.io
2026-10-17 06:37:52
(6 hours ago)
{"level":"info","ts":1792219072.0085936,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1792219072.0085936,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.105.175","remote_port":"39618","client_ip":"34.159.105.175","proto":"HTTP/2.0","method":"GET","host":"status.trillianthealth.com","uri":"/manifest.json","headers":{"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua-Mobile":["?1"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Microsoft Edge\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Priority":["u=0, i"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"],"Sec-Ch-Ua-Platform":["\"Android\""],"Sec-Fetch-User":["?1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/
...
show less
DDoS Attack
Web App Attack
🇫🇷
security.rdmc.fr
2026-10-17 05:50:14
(6 hours ago)
Web scan: requests for sensitive files
Web App Attack
Bad Web Bot
🇳🇱
Site.eu
2026-10-17 01:51:33
(10 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
IVski.com
2026-10-17 00:30:05
(12 hours ago)
IVski WAF | WordPress scanner detected - probing wp-content, xmlrpc or wp-login
Hacking
Brute-Force
Web App Attack
2026-10-16 20:10:33
(16 hours ago)
34.159.105.175 - - [16/Oct/2026:20:10:32 +0000] "-" 400 166 "-" "-"
34.159.105.175 - - [16/Oct/2026: ...
show more
34.159.105.175 - - [16/Oct/2026:20:10:32 +0000] "-" 400 166 "-" "-"
34.159.105.175 - - [16/Oct/2026:20:10:32 +0000] "-" 400 166 "-" "-"
34.159.105.175 - - [16/Oct/2026:20:10:32 +0000] "-" 400 166 "-" "-"
...
show less
Brute-Force
🇺🇸
drewking
2026-10-16 19:59:10
(16 hours ago)
Rate-limit abuse — 116 requests in a short window (brute-force / scraping). Targeted paths: /firebas ...
show more
Rate-limit abuse — 116 requests in a short window (brute-force / scraping). Targeted paths: /firebase-admin.json, /keys/service-account.json, /gcp-key.json, /firebase-credentials.json, /reset-password.
show less
Web App Attack
Brute-Force
Bad Web Bot
🇧🇪
cmbplf
2026-10-16 18:32:27
(18 hours ago)
250 requests with url.path */@fs/*
128 requests with url.path */proc/*
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-16 17:32:45
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.159.105.175 (175.105.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.105.175 (175.105.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 13:32:38.426074 2026] [security2:error] [pid 25313:tid 25313] [client 34.159.105.175:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.ndanetworks.com|F|2"] [data ".ndanetworks.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.ndanetworks.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.ndanetworks.com"] [unique_id "atJftrPEKW1VXOkOou6p6gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
LoneRider
2026-10-16 16:40:02
(20 hours ago)
[16/Oct/2026:18:39:59.971758 +0200] atJTX2ukRA-xBsURZN2qsAAAAAE 34.159.105.175 46536 127.0.0.1 7081
...
show more
[16/Oct/2026:18:39:59.971758 +0200] atJTX2ukRA-xBsURZN2qsAAAAAE 34.159.105.175 46536 127.0.0.1 7081
[16/Oct/2026:18:40:01.487360 +0200] atJTYaPs7-WvNh5JMQabdgAAAAU 34.159.105.175 46860 127.0.0.1 7081
[16/Oct/2026:18:40:01.606894 +0200] atJTYS2XeVyKbVTiDSFTRwAAAAo 34.159.105.175 46906 127.0.0.1 7081
...
show less
Hacking
2026-10-16 16:12:09
(20 hours ago)
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /auth HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windo ...
show more
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /auth HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /register HTTP/1.1" 404 5516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /z9x8c7v6b5-debug-trigger-stage.nederlandsefilmacademie.com HTTP/1.1" 403 5538 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /dashboard HTTP/1.1" 404 5516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.159.105.175 - - [16/Oct/2026:18:12:08 +0200] "GET /account HTTP/1.1" 404 5516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
...
show less
DDoS Attack
2026-10-16 15:45:49
(21 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇬🇧
consul.to
2026-10-16 15:05:16
(21 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
e.fierstra
2026-10-16 14:59:55
(21 hours ago)
excessive HTTP 404 errors
Bad Web Bot
🇨🇭
🇨🇭 Hosting
2026-10-16 05:10:18
(1 day ago)
Automated WAF report: 300-400 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack