🇳🇱
homeshowdomain.nl
2026-06-15 22:02:04
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-14.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-06-15 17:56:38
(1 month ago)
(mod_security) mod_security (id:210831) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210831) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 13:56:32.084393 2026] [security2:error] [pid 8280:tid 8280] [client 34.176.176.250:55928] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||peazy.net|F|4"] [data "grub-client"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "peazy.net"] [uri "/db.zip"] [unique_id "ajA80Hf_OyiaHuPrp3bR7gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-15 14:22:09
(1 month ago)
15 attempts against mh-modsecurity-ban on ice
Brute-Force
Web App Attack
2026-06-15 09:47:38
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇳🇱
Savvii
2026-06-15 05:47:14
(1 month ago)
20 attempts against mh-misbehave-ban on joost-dev
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-06-15 03:15:15
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:30:20
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:30:05.225132 2026] [security2:error] [pid 20664:tid 20664] [client 34.176.176.250:54314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sanmarinoresidentagent.com"] [uri "/api/v2/.env"] [unique_id "ai85fQTzgnPKGlm-6kRKIwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 21:16:26
(1 month ago)
fail2ban:piguard2:18,19,21
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-14 18:07:55
(1 month ago)
Multiple WAF Violations
Web App Attack
🇭🇰
Harold Wong
2026-06-14 17:05:15
(1 month ago)
$f2bV_matches
Brute-Force
🇳🇱
Savvii
2026-06-14 11:56:44
(1 month ago)
82 attempts against mh-misbehave-ban on glow
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 05:56:50
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.176.250 (250.176.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 01:56:47.041084 2026] [security2:error] [pid 25696:tid 25696] [client 34.176.176.250:39570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.haco.rcto.us"] [uri "/.env.prod"] [unique_id "ai5Cn8H9IWqHO2bx5y2e9AAAAGg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 05:09:04
(1 month ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
mnsf
2026-06-14 04:10:46
(1 month ago)
Scanning/Probing (68)
Brute-Force
Web App Attack
🇳🇱
0xffffffff
2026-06-14 04:07:42
(1 month ago)
[2026-06-14 07:07:40.384061] [authz_core:error] [pid 350561:tid 136825357207232] [client 34.176.176. ...
show more
[2026-06-14 07:07:40.384061] [authz_core:error] [pid 350561:tid 136825357207232] [client 34.176.176.250:0] AH01630: client denied by server configuration: /var/www/*/.env.prod.bak , error_notes:backup-files , URI:'/.env.prod.bak'
[2026-06-14 07:07:40.414009] [authz_core:error] [pid 353795:tid 136825290065600] [client 34.176.176.250:0] AH01630: client denied by server configuration: /var/www/*/.env.production.bak , error_notes:backup-files , URI:'/.env.production.bak'
[2026-06-14 07:07:40.415688] [authz_core:error] [pid 350562:tid 136825373992640] [client 34.176.176.250:0] AH01630: client denied by server configuration: /var/www/*/.env.copy , error_notes:dot-files , URI:'/.env.copy'
[2026-06-14 07:07:40.420757] [authz_core:error] [pid 353795:tid 136825281672896] [client 34.176.176.250:0] AH01630: client denied by server configuration: /var/www/*/.env.dev , error_notes:dot-files , URI:'/.env.dev'
[2026-06-14 07:07:40.424895] [authz_core:error] [pid 350562:tid 136825365599936] [client 34.176.176.250:0] AH01630:
show less
Web App Attack
Bad Web Bot