2026-11-03 12:25:21
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-30 23:04:43
UTC ·
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-29.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-30 17:01:17
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.159.118.136 (136.118.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 13:01:10.540513 2026] [security2:error] [pid 16176:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.118.136 (136.118.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 13:01:10.540513 2026] [security2:error] [pid 16176:tid 16176] [client 34.159.118.136:51742] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||zabbix.betgoto.com|F|2"] [data ".betgoto.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "zabbix.betgoto.com"] [uri "/z9x8c7v6b5-debug-trigger-zabbix.betgoto.com"] [unique_id "auTNVg38LFXIpJwavkSo5QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-30 17:01:00
UTC ·
(2 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
mbch
2026-10-30 16:52:22
UTC ·
(2 weeks ago)
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-30T16:52:22.526000+00:00 to 2026-10-30T16:52:23.390000+00:00: 10 distinct paths in 0.864s, denied HTTP 404. Trusted client-IP processing; forw ...
show more
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-30T16:52:22.526000+00:00 to 2026-10-30T16:52:23.390000+00:00: 10 distinct paths in 0.864s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /build/manifest.json, /dist/manifest.json, /dist/.vite/manifest.json, /static/app/.env, /static/.env, /.vite/manifest.json, /.env, /static/home/user/.env, /static/..;/..;/..;/..;/proc/self/environ, /api/.env/public/.env.
show less
Web App Attack
🇧🇷
radardatelecom
2026-10-30 16:52:03
UTC ·
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-10-30 16:45:55
UTC ·
(2 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇳🇱
middelkoopcc
2026-10-30 16:35:13
UTC ·
(2 weeks ago)
2026-10-30 17:33:05 GET /key.json [404] && 2026-10-30 17:33:05 GET /serviceAccountKey.json [404] && 2026-10-30 17:33:05 GET /firebase-service-account.json [404] && 234 more within 20 minutes
Web App Attack
2026-10-30 16:30:05
UTC ·
(2 weeks ago)
| Common web attack.
Web App Attack
Hacking
SQL Injection
🇳🇱
Alt255
2026-10-30 16:27:10
UTC ·
(2 weeks ago)
[ti-14al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail <name>. Example: 34.159.118.136 - - \[30/Oct/2026:17:27:06 +0100\] "GET /z9x8c7v6b5-debug-trigger-cms.beewand.nl HTTP/1.1" 404 2105 "-" "DuckAssistBot/1.1 ...
show more
[ti-14al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail <name>. Example: 34.159.118.136 - - \[30/Oct/2026:17:27:06 +0100\] "GET /z9x8c7v6b5-debug-trigger-cms.beewand.nl HTTP/1.1" 404 2105 "-" "DuckAssistBot/1.1 \(https://duckduckgo.com/duckassistbot\)"
34.159.118.136 - - \[30/Oct/2026:17:27:06 +0100\] "GET /mvz86ztx67gkwvlite0a HTTP/1.1" 404 2105 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\)\; compatible\; OAI-SearchBot/1.0\; +https://openai.com/searchbot"
34.159.118.136 - - \[30/Oct/2026:17:27:06 +0100\] "GET /9wogd4tcb0vqamu6qhyp HTTP/1.1" 404 3632 "-" "Mozilla/5.0 \(compatible\; DeepSeekBot/1.0\; +https://www.deepseek.com/\)"
34.159.118.136 - - \[30/Oct/2026:17:27:06 +0100\] "POST /graphql HTTP/1.1" 404 3632 "https://cms.beewand.nl" "Mozilla/5.0 \(Windows NT 1
...
show less
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-10-30 16:23:58
UTC ·
(2 weeks ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇸🇪
vaia.cloud
2026-10-30 16:20:02
UTC ·
(2 weeks ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇩🇪
Marc
2026-10-30 16:02:37
UTC ·
(2 weeks ago)
34.159.118.136 - - [30/Oct/2026:17:02:37 +0100] "GET /sitemap.xml HTTP/2.0" 404 314 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.159.118.136 - - [30/Oct/2026:17:0 ...
show more
34.159.118.136 - - [30/Oct/2026:17:02:37 +0100] "GET /sitemap.xml HTTP/2.0" 404 314 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.159.118.136 - - [30/Oct/2026:17:02:37 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 34.159.118.136 - - [30/Oct/2026:17:02:37 +0100] "GET /playground HTTP/2.0" 404 269 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
show less
Brute-Force
2026-10-30 16:02:07
UTC ·
(2 weeks ago)
Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Probing for exposed secret / credential files; Web application attack: http sensitive files
Hacking
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-30 16:00:25
UTC ·
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
