๐ณ๐ฑ
Alt255
2026-10-23 17:11:35
(8 hours ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.163.84.239 - - [23/Oct/2026:19:11:28 +0200] "GET /.git/config HTTP/1.1" 301 604 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Site.eu
2026-10-23 12:44:10
(13 hours ago)
Excessive 404/403 errors
Brute-Force
๐ต๐ฑ
Budyn
2026-10-22 15:12:45
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.dont-eat-the-pudding.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"34.163.84.239","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e9712e8fe1c0a4-CDG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-N
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 13:45:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 09:45:43.648464 2026] [security2:error] [pid 1844:tid 1844] [client 34.163.84.239:60010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.disneyweddinginvitations.com"] [uri "/.git/config"] [unique_id "atoTh5g3fvJHDH2Ag8CU7gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 13:00:51
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 09:00:43.791100 2026] [security2:error] [pid 27554:tid 27554] [client 34.163.84.239:49722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.diarrheawolves.com"] [uri "/.git/config"] [unique_id "atoI--THpK4-FHPGiARqdwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 12:11:38
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 08:11:31.682871 2026] [security2:error] [pid 19540:tid 19689] [client 34.163.84.239:46504] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.destination-kitchen.com"] [uri "/.git/config"] [unique_id "atn9c_B_X2z1k2tzYjp7_QAAAhQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 11:39:24
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:39:20.845479 2026] [security2:error] [pid 24006:tid 24006] [client 34.163.84.239:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.demondomain.com"] [uri "/.git/config"] [unique_id "atn16F1lLyKLEmR2vO0k3wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ต๐ฑ
Budyn
2026-10-22 11:21:05
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.definitelynotahoneypot.online | URI: /.git/config | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"34.163.84.239","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e81dd2691c023a-CDG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-Nextjs-Re
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 02:43:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:43:32.514126 2026] [security2:error] [pid 31832:tid 31832] [client 34.163.84.239:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.cloudex.click"] [uri "/.git/config"] [unique_id "atl4VMA8ab3UOb-7rptX_QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฎ๐น
VHosting
2026-10-22 01:25:03
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
๐ณ๐ฑ
homeshowdomain.nl
2026-10-21 22:00:20
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-20.
show less
Web App Attack
SSH
Hacking
๐ฟ๐ฆ
conure.sh
2026-10-21 12:03:02
(2 days ago)
csagent: score 19.9: secrets grab x2; 1 domain(s) in 2s
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-21 04:42:17
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 00:42:13.683177 2026] [security2:error] [pid 26431:tid 26431] [client 34.163.84.239:54784] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.feaverslane.com"] [uri "/.git/config"] [unique_id "athCpe6FMtZ9jce_BO3cbgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-21 03:11:00
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.163.84.239 (239.84.163.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 23:10:53.540659 2026] [security2:error] [pid 26765:tid 26765] [client 34.163.84.239:47770] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.fairfieldfarms.net"] [uri "/.git/config"] [unique_id "atgtPc8j1mTFeT6KinkPpQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
rellik
2026-10-21 02:19:00
(2 days ago)
Brute Force Scanning Critical Files & Directories
Hacking
Brute-Force
Web App Attack