🇺🇸
jormaster3k
2026-10-21 10:32:43
(20 hours ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
Bedios GmbH
2026-10-21 08:53:36
(22 hours ago)
Scanning for exposed credentials and private keys
Hacking
🇵🇱
swiszczu
2026-10-21 07:54:28
(23 hours ago)
Fail2Ban automatic report:
Multiple forbidden requests in short amount of time:
34.179.143.104 - - [ ...
show more
Fail2Ban automatic report:
Multiple forbidden requests in short amount of time:
34.179.143.104 - - [21/Oct/2026:09:54:27 +0200] "GET /.ssh/id_rsa HTTP/2.0" 403 153 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" "-"
34.179.143.104 - - [21/Oct/2026:09:54:27 +0200] "GET /.azure/accessTokens.json HTTP/2.0" 403 153 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-"
34.179.143.104 - - [21/Oct/2026:09:54:27 +0200] "GET /.env.secret HTTP/2.0" 403 153 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" "-"
34.179.143.104 - - [21/Oct/2026:09:54:27 +0200] "GET /.ssh/config HTTP/2.0" 403 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" "-"
34.179.143.104 - - [21/Oct/2026:09:54:27 +0200] "GET /.env.production.local HTTP/2.0" 403 153 "-"
show less
Hacking
Web App Attack
🇵🇱
mscode.pl
2026-10-21 06:41:31
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (POST method)
Zone: analytics.mscode.pl
Endpoint: /icecoder/lib/file-control.php
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )
show less
Bad Web Bot
🇳🇱
ConsulHosting
2026-10-21 05:19:04
(1 day ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇿🇦
Megasurf
2026-10-21 05:13:04
(1 day ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firew ...
show more
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
show less
Web App Attack
2026-10-21 05:12:35
(1 day ago)
[ns41.kdns.gr] httpd-config-scan: sites=www.medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; ...
show more
[ns41.kdns.gr] httpd-config-scan: sites=www.medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samples=/@fs/app/.env?raw?? | /wp-admin/.env | /@fs/../.env?raw??
show less
Hacking
Web App Attack
2026-10-21 05:10:08
(1 day ago)
Aggressive web scan
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-21 02:43:50
(1 day ago)
Modsecurity: probe or injection attempt
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:43:24
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.179.143.104 (104.143.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.143.104 (104.143.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:43:19.157049 2026] [security2:error] [pid 21919:tid 21919] [client 34.179.143.104:42862] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.edelbaumarchitect.com"] [uri "/.env.supabase"] [unique_id "atgmxy_Ggk8lRPi5NAM1PwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ecs.ge
2026-10-21 02:41:55
(1 day ago)
Automatic Fail2Ban report from jail plesk-apache: multiple matching events detected.
Brute-Force
🇳🇱
Alt255
2026-10-21 02:31:56
(1 day ago)
[mx03al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[mx03al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.179.143.104 - - [21/Oct/2026:04:31:41 +0200] "GET /backend/.env HTTP/2.0" 301 324 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:23:38
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.179.143.104 (104.143.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.143.104 (104.143.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:23:31.560606 2026] [security2:error] [pid 21246:tid 21246] [client 34.179.143.104:36536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.dylanwalsh.net"] [uri "/.htpasswd"] [unique_id "atgiI8L6gqNwEEYPP7NoOwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
✨
2026-10-21 02:23:19
(1 day ago)
Domain : MailEnable WebMail
Rule : hack
2026-10-21 02:21:51 ***hidden-privacy*** GET /@fs/var/run/se ...
show more
Domain : MailEnable WebMail
Rule : hack
2026-10-21 02:21:51 ***hidden-privacy*** GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token raw?? 443 - 34.179.143.104 Mozilla/5.0 (compatible; DeepSeekBot/1.0; https://www.deepseek.com/) - 404 0 2 1559 499 125 - -
show less
Hacking
SQL Injection
Brute-Force
🇺🇸
hostmach
2026-10-21 02:13:36
(1 day ago)
(cpanel) Failed cPanel login from 34.179.143.104 (DE/Germany/104.143.179.34.bc.googleusercontent.com ...
show more
(cpanel) Failed cPanel login from 34.179.143.104 (DE/Germany/104.143.179.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-10-20 22:13:30 -0400] info [webmaild] 34.179.143.104 - - "GET /9uj6mr40j7gp4yjppmfv HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-10-20 22:13:32 -0400] info [webmaild] 34.179.143.104 - - "GET /403.shtml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-10-20 22:13:32 -0400] info [webmaild] 34.179.143.104 - - "GET /.aws/config HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-10-20 22:13:32 -0400] info [webmaild] 34.179.143.104 - - "GET /build/.env HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-10-20 22:13:32 -0400] info [webmaild] 34.179.143.104 - - "GET /403.shtml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
show less
Brute-Force
SSH