🇺🇸
antlac1
2026-11-11 11:15:22
UTC ·
(2 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 09:27:41
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.165.223.171 (171.223.165.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:27:34.820429 2026] [security2:error] [pid 28387:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.165.223.171 (171.223.165.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:27:34.820429 2026] [security2:error] [pid 28387:tid 28387] [client 34.165.223.171:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caspina.com"] [uri "/.git/config"] [unique_id "avQ1Bjz66iScqYeROYy9MQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-11-11 04:28:52
UTC ·
(2 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-10 19:08:14
UTC ·
(2 days ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-10 14:35:08
UTC ·
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-11-10 14:14:27
UTC ·
(2 days ago)
10/Nov/2026:14:14:24 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/.git/config"
10/Nov/2026:14:14:26 +0000;34.165.223.171;"/"
10/Nov/20 ...
show more
10/Nov/2026:14:14:24 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:25 +0000;34.165.223.171;"/.git/config"
10/Nov/2026:14:14:26 +0000;34.165.223.171;"/"
10/Nov/2026:14:14:26 +0000;34.165.223.171;"/.env"
10/Nov/2026:14:14:26 +0000;34.165.223.171;"/.env.local"
...
show less
Web Spam
Brute-Force
Web App Attack
🇳🇬
lendsqr
2026-11-10 12:06:43
UTC ·
(3 days ago)
Automated attack on our web servers: asked for 240 secret-file paths. Blocked.
Bad Web Bot
Web App Attack
🇿🇦
Megasurf
2026-11-10 10:52:55
UTC ·
(3 days ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
Web App Attack
🇨🇭
4server
2026-11-10 09:34:56
UTC ·
(3 days ago)
[TueNov1010:34:50.9581262026][security2:error][pid4131499:tid4131636][client34.165.223.171:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\ ...
show more
[TueNov1010:34:50.9581262026][security2:error][pid4131499:tid4131636][client34.165.223.171:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"creazione-siti-ticino.ch\"][uri\"/\"][unique_id\"avLlOnn8hE8dLm-dp5wC4QAAAFA\"]
show less
Hacking
Web App Attack
🇺🇦
URAN Publishing Service
2026-11-10 06:59:12
UTC ·
(3 days ago)
[10/Nov/2026:08:59:12 +0200] -- 34.165.223.171 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-11-10 05:50:32
UTC ·
(3 days ago)
20 attempts against mh-misbehave-ban on ec102933
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-10 04:23:56
UTC ·
(3 days ago)
cloudlinux2 fail2ban: 2026-11-10 05:18:49,455 fail2ban.filter [1667]: INFO [plesk-modsecurity] Found 34.165.223.171 - 2026-11-10 05:18:49cloudlinux2 fail2ban: 2026-11-10 05:18:49,482 fail2ban.filter [1667]: INFO [recidive] Found ...
show more
cloudlinux2 fail2ban: 2026-11-10 05:18:49,455 fail2ban.filter [1667]: INFO [plesk-modsecurity] Found 34.165.223.171 - 2026-11-10 05:18:49cloudlinux2 fail2ban: 2026-11-10 05:18:49,482 fail2ban.filter [1667]: INFO [recidive] Found 34.165.223.171 - 2026-11-10 05:18:49cloudlinux2 fail2ban: 2026-11-10 05:18:48,936 fail2ban.filter [1667]: INFO [plesk-modsecurity] Found 34.165.223.171 - 2026-11-10 05:18:48cloudlinux2 fail2ban: 2026-11-10 05:18:49,476 fail2ban.actions [1667]: NOTICE [plesk-modsecurity] Ban 34.165.223.171cloudlinux2 fail2ban: 2026-11-10 05:18:49,267 fail2ban.filter [1667]: INFO [plesk-modsecurity] Found 34.165.223.171 - 2026-11-10 05:18:49cloudlinux2 fail2ban: 2026-11-10 05:19:39,821 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 45.132.227.160 - 2026-11-10 05:19:38cloudlinux2 fail2ban: 2026-11-10 05:20:20,037 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 193.36.224.177 - 2026-11-10 05:20:19cloudlinux2 fail2ban: 202
show less
Web App Attack
2026-11-10 02:20:42
UTC ·
(3 days ago)
Aggressive web scan
Web App Attack
🇳🇱
Alt255
2026-11-09 22:18:06
UTC ·
(3 days ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.165.223.171 - - [09/Nov/2026:23:18:01 +0100] "GET /.git/config HTTP/1.1" 301 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.165.223.171 - - [09/Nov/2026:23:18:01 +0100] "GET /.git/config HTTP/1.1" 301 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-09 21:09:13
UTC ·
(3 days ago)
Secret file probe | method: GET | path: /.env, /.env.local, /.env.production (+1 more) | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking
Web App Attack
