🇩🇪
sebham03
2026-11-12 22:00:14
UTC ·
(12 hours ago)
Automated sensitive-file/web application probing observed from 2026-11-12T20:55:14+00:00 to 2026-11-12T22:00:14+00:00 UTC.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 20:35:09
UTC ·
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.178.141.187 (187.141.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:35:05.450476 2026] [security2:error] [pid 29990:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.178.141.187 (187.141.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:35:05.450476 2026] [security2:error] [pid 29990:tid 29990] [client 34.178.141.187:55504] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "files.nautos-usa.com"] [uri "/.git/config"] [unique_id "avYi-a0x8R2siQaFbRYKCAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sonoflet
2026-11-12 19:41:00
UTC ·
(15 hours ago)
CrowdSec detection | scenario: appsec-vpatch
Web App Attack
🇩🇪
konseptit
2026-11-12 19:24:56
UTC ·
(15 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.178.141.187 (NL/The Netherlands/187.141.178.34.bc.googleusercontent.com)
SQL Injection
🇵🇱
itsvic.dev
2026-11-12 19:01:28
UTC ·
(15 hours ago)
34.178.141.187 - - [12/Nov/2026:19:01:27 +0000] "files.itsvic.dev" "GET /.git/config HTTP/1.1" 404 382 294 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.178.141.187 - - [12/No ...
show more
34.178.141.187 - - [12/Nov/2026:19:01:27 +0000] "files.itsvic.dev" "GET /.git/config HTTP/1.1" 404 382 294 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.178.141.187 - - [12/Nov/2026:19:01:27 +0000] "files.itsvic.dev" "GET /.env HTTP/1.1" 404 382 287 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.178.141.187 - - [12/Nov/2026:19:01:28 +0000] "files.itsvic.dev" "GET /.env.local HTTP/1.1" 404 382 293 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇬🇷
setupgr
2026-11-12 18:55:26
UTC ·
(15 hours ago)
(mod_security) mod_security (id:11000011) triggered by 34.178.141.187 (NL/The Netherlands/Groningen/Groningen/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:55:25.8 ...
show more
(mod_security) mod_security (id:11000011) triggered by 34.178.141.187 (NL/The Netherlands/Groningen/Groningen/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:55:25.876683 2026] [security2:error] [pid 1942345:tid 1942788] [client 34.178.141.187:36288] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 187.141.178.34.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "files.ions.gr"] [uri "/"] [unique_id "avYLnV0k76x-8f7P32531wAAA1I"]
show less
Port Scan
🇬🇧
gws-hostmaster
2026-11-12 18:11:09
UTC ·
(16 hours ago)
ModSecurity OWASP CRS (Anomaly Score: 50): JavaScript Prototype Pollution;JSON-Based SQL Injection;Node.js Injection Attack 1/2;PHP Injection Attack: Variable Access Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Executi ...
show more
ModSecurity OWASP CRS (Anomaly Score: 50): JavaScript Prototype Pollution;JSON-Based SQL Injection;Node.js Injection Attack 1/2;PHP Injection Attack: Variable Access Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Unix Shell Expression Found;Restricted File Access Attempt;SQL Injection Attack: SQL function name detected;
show less
Web App Attack
🇰🇷
fanbinit
2026-11-12 17:27:31
UTC ·
(17 hours ago)
Repeated requests for sensitive configuration or repository paths.
Web App Attack
🇺🇸
pszsh
2026-11-12 17:12:54
UTC ·
(17 hours ago)
Automated probing for exposed secrets and version-control internals: 3 requests for non-existent sensitive paths, e.g. /.git/config /.env /.env.local. Observed by an nginx reputation gate; no credentials or user data involved.
Web App Attack
🇧🇷
ICS Labs
2026-11-12 14:39:59
UTC ·
(20 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-12 UTC.
Brute-Force
2026-11-12 12:27:05
UTC ·
(22 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-11-12 12:05:05
UTC ·
(22 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-12 11:57:34
UTC ·
(22 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-12 11:50:30
UTC ·
(22 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-12 11:46:58
UTC ·
(23 hours ago)
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safar ...
show more
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
Requested, e.g.:
- k8s.[REDACTED]/
show less
Bad Web Bot
