🇳🇱
homeshowdomain.nl
2026-11-09 23:01:02
UTC ·
(4 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-08.
Web App Attack
SSH
Hacking
🇧🇷
ICS Labs
2026-11-09 20:07:09
UTC ·
(4 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-11-09 UTC.
Brute-Force
Exploited Host
🇳🇱
i-turnradio.nl
2026-11-09 04:38:13
UTC ·
(5 days ago)
2026-11-09 @ 05:38:05 (CET) ~ Blocked for trying to access: /_ignition/health-check
Web App Attack
🇵🇱
Budyn
2026-11-09 04:08:05
UTC ·
(5 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: forum.definitelynotahoneypot.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10. ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: forum.definitelynotahoneypot.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-09 03:57:11
UTC ·
(5 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 03:28:46
UTC ·
(5 days ago)
(mod_security) mod_security (id:248270) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 22:28:42.168431 2026] [security2:error] [pid 12233:tid ...
show more
(mod_security) mod_security (id:248270) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 22:28:42.168431 2026] [security2:error] [pid 12233:tid 12233] [client 34.168.89.150:18554] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||www.estate36.yankeetownfishing.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.estate36.yankeetownfishing.com"] [uri "/"] [unique_id "avE96lnWwqRACsMEV-QFkwAAABQ"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
SystemAdmin
2026-11-09 03:23:09
UTC ·
(5 days ago)
Doing bad things...
Web App Attack
🇩🇰
HostingGroup
2026-11-08 18:31:53
UTC ·
(6 days ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 8. First blocked: 2026-11-08.
Bad Web Bot
Web App Attack
2026-11-08 17:24:07
UTC ·
(6 days ago)
[ns3.backorder.gr] httpd-config-scan: sites=iatrika-analosima.gr; logs=/var/log/httpd/domains/iatrika-analosima.gr.log; samples=/.git/head | /.git/head | /.git/hooks/post-receive
Hacking
Web App Attack
🇷🇴
iulianh
2026-11-08 17:12:01
UTC ·
(6 days ago)
80,443
Brute-Force
SSH
🇷🇺
Deynekin.com
2026-11-08 15:56:37
UTC ·
(6 days ago)
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-08T18:56:37+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: ...
show more
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-11-08T18:56:37+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: 1d.
Sample requests/indicators:
GET /.git/HEAD -> 404
GET /assets/config.json -> 404
GET /static/config.json -> 404
No personal data included.
--
Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:39:44
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:39:37.747575 2026] [security2:error] [pid 25079:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:39:37.747575 2026] [security2:error] [pid 25079:tid 25079] [client 34.168.89.150:36300] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fruitacpa.com"] [uri "/.git/HEAD"] [unique_id "avB7maoaL81dJtF8HewCOQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-08 11:45:08
UTC ·
(6 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-08 11:43:38
UTC ·
(6 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 10:27:29
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:27:25.541175 2026] [security2:error] [pid 22613:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.168.89.150 (150.89.168.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:27:25.541175 2026] [security2:error] [pid 22613:tid 22613] [client 34.168.89.150:64322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "treeofloveproductions.com"] [uri "/.git/HEAD"] [unique_id "avBOjYRkLolscb6oT5d11gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
