🇨🇭
TheCoon
2026-11-08 11:05:20
UTC ·
(4 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-24 16:27:06
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:32:04
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-21 06:54:38
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇮🇳
evicky2002
2026-05-14 06:00:00
UTC ·
(5 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-05-09 22:00:21
UTC ·
(6 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-08.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-08 06:39:47
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 02:39:40.609868 2026] [security2:error] [pid 26055:tid 2605 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 02:39:40.609868 2026] [security2:error] [pid 26055:tid 26055] [client 34.175.8.97:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ccamp.dev"] [uri "/.git/config"] [unique_id "af2FLNuEH9yXfX7ut6DWgwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-05-08 06:29:47
UTC ·
(6 months ago)
[FriMay0808:29:44.8842332026][security2:error][pid1523433:tid1523549][client34.175.8.97:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d ...
show more
[FriMay0808:29:44.8842332026][security2:error][pid1523433:tid1523549][client34.175.8.97:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"198\"][id\"330039\"][rev\"4\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(libwww-perl\).Disablethisruleifyouuselibwww-perl.\"][severity\"CRITICAL\"][hostname\"nobsarredamenti.ch.136-243-54-122.cpanel.site\"][uri\"/.git/config\"][unique_id\"af2C2IDvf332P3AgkgG6OQAAANE\"]
show less
Port Scan
Brute-Force
Web App Attack
🇦🇺
2000cn.com.au
2026-05-08 06:09:37
UTC ·
(6 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-05-08 05:49:47
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:49:39.421138 2026] [security2:error] [pid 18896:tid 1889 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:49:39.421138 2026] [security2:error] [pid 18896:tid 18896] [client 34.175.8.97:32944] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mukau.com"] [uri "/.git/config"] [unique_id "af15c3tWtjMhMWkbPqz__gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-05-08 05:29:48
UTC ·
(6 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.175.8.97 (ES/Spain/97.8.175.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-197)
Hacking
🇺🇸
TPI-Abuse
2026-05-08 04:59:37
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:59:33.772523 2026] [security2:error] [pid 9421:tid 9421] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:59:33.772523 2026] [security2:error] [pid 9421:tid 9421] [client 34.175.8.97:45334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "livinghopehighschool.org"] [uri "/.git/config"] [unique_id "af1ttQs50uev0T8dGrOdCgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 04:39:33
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:39:26.640877 2026] [security2:error] [pid 8549:tid 8549] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.175.8.97 (97.8.175.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:39:26.640877 2026] [security2:error] [pid 8549:tid 8549] [client 34.175.8.97:33336] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.karsini-services.com"] [uri "/.git/config"] [unique_id "af1o_vHUy1YTxWLE2YDJjwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
piticu iuli
2026-05-08 04:29:46
UTC ·
(6 months ago)
(mod_security) mod_security triggered on hostname [redacted] 34.175.8.97 (ES/Spain/97.8.175.34.bc.googleusercontent.com)
SQL Injection
🇨🇿
ddw
2026-05-08 04:09:38
UTC ·
(6 months ago)
ModSecurity detection - Rules: 930130(Restricted File Access Attempt)
Web App Attack
