🇬🇧
andypiper
2026-10-21 01:00:16
(1 day ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-21 00:16:31
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
2026-10-21 00:12:10
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-10-21 00:11:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.159.210.16 (16.210.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.210.16 (16.210.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 20:11:02.453804 2026] [security2:error] [pid 31894:tid 31894] [client 34.159.210.16:40948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.virantenn.com"] [uri "/.env.supabase"] [unique_id "atgDFqdc80uT1Fq4QX7G9QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 23:55:47
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.159.210.16 (16.210.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.210.16 (16.210.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 19:55:40.036723 2026] [security2:error] [pid 12460:tid 12460] [client 34.159.210.16:45274] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.waterjetsolutions.com"] [uri "/media../.env"] [unique_id "atf_fNBpZUUw0D0QUxkCVAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-20 22:57:31
(1 day ago)
{"level":"info","ts":1792537050.7626715,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1792537050.7626715,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.210.16","remote_port":"38360","client_ip":"34.159.210.16","proto":"HTTP/2.0","method":"GET","host":"status.webbab.se","uri":"/docker/.env","headers":{"Accept-Encoding":["gzip"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"],"Accept":["*/*"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.webbab.se","ech":false}},"bytes_read":0,"user_id":"","duration":0.000101935,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1792537050.7628956,"logger":"http.
...
show less
DDoS Attack
Web App Attack
🇹🇷
Jova
2026-10-20 21:45:20
(1 day ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇬🇧
WebNiraj
2026-10-20 21:05:08
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 34.159.210.16 (DE/Germany/16.210.159.34.bc.goog ...
show more
(mod_security) mod_security (id:949110) triggered by 34.159.210.16 (DE/Germany/16.210.159.34.bc.googleusercontent.com): 5 in the last 3600 secs [SIGMA]
show less
Brute-Force
🇺🇸
jormaster3k
2026-10-20 20:53:13
(1 day ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
kkw
2026-10-20 20:10:23
(1 day ago)
[REDACTED] 34.159.210.16 - - [20/Oct/2026:22:10:21 +0200] "GET /.env?.svg?.wasm?init HTTP/2.0" 301 4 ...
show more
[REDACTED] 34.159.210.16 - - [20/Oct/2026:22:10:21 +0200] "GET /.env?.svg?.wasm?init HTTP/2.0" 301 422 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
... (mode: searching http-sensitive-files)
show less
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-20 18:56:32
(1 day ago)
csagent: score 21.5: 404 noise floor x6, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇷🇴
gtheo99
2026-10-20 18:35:28
(1 day ago)
(mod_security) mod_security (id:900006) triggered by 34.159.210.16 (DE/Germany/16.210.159.34.bc.goog ...
show more
(mod_security) mod_security (id:900006) triggered by 34.159.210.16 (DE/Germany/16.210.159.34.bc.googleusercontent.com): 3 in the last 900 secs (CF_ENABLE)
show less
Port Scan
🇲🇾
Rizzy
2026-10-20 18:33:13
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-10-20 17:21:34
(1 day ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
rsa
2026-10-20 16:56:00
(1 day ago)
GET /workspace/ HTTP/2.0
GET /api-keys HTTP/2.0
DDoS Attack
Exploited Host
Web App Attack
