🇿🇦
conure.sh
2026-11-13 14:36:12
UTC ·
(4 hours ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x1; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 13:13:57
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:13:54.398583 2026] [security2:error] [pid 13832:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:13:54.398583 2026] [security2:error] [pid 13832:tid 13832] [client 34.176.19.161:42286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enselme.com"] [uri "/.git/config"] [unique_id "avcNEjrrIJf3XmBJxDhBlwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-13 10:28:47
UTC ·
(8 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 10:15:42
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:15:35.856700 2026] [security2:error] [pid 22566:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:15:35.856700 2026] [security2:error] [pid 22566:tid 22566] [client 34.176.19.161:54174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enrimejia.com"] [uri "/.git/config"] [unique_id "avbjRyyGhuGwkZoLREXBCwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-11-13 09:59:23
UTC ·
(8 hours ago)
[FriNov1310:59:20.9863602026][security2:error][pid2630968:tid2631009][client34.176.19.161:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\} ...
show more
[FriNov1310:59:20.9863602026][security2:error][pid2630968:tid2631009][client34.176.19.161:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"enricoalbertini.com\"][uri\"/\"][unique_id\"avbfeNv336Kr_TBPpeMiBAAAAEU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-11-13 09:31:49
UTC ·
(9 hours ago)
378 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇳🇱
Alt255
2026-11-13 08:34:31
UTC ·
(10 hours ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.176.19.161 - - [13/Nov/2026:09:34:28 +0100] "GET /.git/config HTTP/1.1" 404 2104 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.176.19.161 - - [13/Nov/2026:09:34:28 +0100] "GET /.git/config HTTP/1.1" 404 2104 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-11-13 06:35:57
UTC ·
(12 hours ago)
[Fri Nov 13 07:35:57.057588 2026] [:error] [pid 326110:tid 326110] [client 34.176.19.161:37680] ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:b[\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x ...
show more
[Fri Nov 13 07:35:57.057588 2026] [:error] [pid 326110:tid 326110] [client 34.176.19.161:37680] ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:b[\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$ (10653 characters omitted)' against variable `ARGS:0' (Value: `{"then": "$1:__proto__:then", "status": "resolved_model", "reason": -1, "value": "{\\"then\\":\\"$B1337 (319 characters omitted)' ) [file "/usr/local/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "186"] [id "932235"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: | base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\
...
show less
Web App Attack
🇫🇷
COMAITE
2026-11-13 06:05:20
UTC ·
(12 hours ago)
Suspicious URL access.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 04:52:56
UTC ·
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 23:52:50.448474 2026] [security2:error] [pid 11016:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 23:52:50.448474 2026] [security2:error] [pid 11016:tid 11071] [client 34.176.19.161:46562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ennerdale.org"] [uri "/.git/config"] [unique_id "avaXou4neCfb_zdrBvljMgAAAVQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-13 04:52:15
UTC ·
(13 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 03:14:11
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:14:08.148804 2026] [security2:error] [pid 24018:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:14:08.148804 2026] [security2:error] [pid 24018:tid 24018] [client 34.176.19.161:37598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enlightened-workplace.com"] [uri "/.git/config"] [unique_id "avaAgBW7wovIe5sFuyPxvAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Philister11
2026-11-13 00:57:43
UTC ·
(17 hours ago)
CrowdSec: crowdsecurity/http-admin-interface-probing (CL/AS396982)
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-13 00:10:22
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:10:18.131198 2026] [security2:error] [pid 20093:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.19.161 (161.19.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:10:18.131198 2026] [security2:error] [pid 20093:tid 20093] [client 34.176.19.161:42744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enjoy2dance.com"] [uri "/.git/config"] [unique_id "avZVakv8a0BEf0ux8WOLJAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 23:23:45
UTC ·
(19 hours ago)
Web application attack: http sensitive files; Probing for exposed secret / credential files
Hacking
Web App Attack
