🇿🇦
conure.sh
2026-11-13 03:48:07
UTC ·
(5 hours ago)
csagent: score 20.5: secrets grab x2, 404 noise floor x2; 1 domain(s) in 0s
Web App Attack
🇳🇱
e.fierstra
2026-11-13 02:16:29
UTC ·
(7 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:48:36
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:48:30.431564 2026] [security2:error] [pid 26515:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:48:30.431564 2026] [security2:error] [pid 26515:tid 26515] [client 34.18.205.205:59476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmroyalties.com"] [uri "/.git/config"] [unique_id "avZeXk69gaSYj_jEyZ93jgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:06:27
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:06:20.252733 2026] [security2:error] [pid 2338:tid 2 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:06:20.252733 2026] [security2:error] [pid 2338:tid 2338] [client 34.18.205.205:56854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmp-ts.com"] [uri "/.git/config"] [unique_id "avZUfLSXxKHdLOTbZ8UpaAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
MatStef132
2026-11-12 22:54:52
UTC ·
(10 hours ago)
MatShield L7: blocked on a protected site (secret-path-probe)
DDoS Attack
🇩🇪
4server
2026-11-12 22:26:09
UTC ·
(11 hours ago)
[ThuNov1223:26:03.8839572026][security2:error][pid1963151:tid1963255][client34.18.205.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"[a-z0-9]~\$\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\ ...
show more
[ThuNov1223:26:03.8839572026][security2:error][pid1963151:tid1963255][client34.18.205.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"[a-z0-9]~\$\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1158\"][id\"390581\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-DataLeakage-attempttoaccessbackupfile\(disablethisruleifyourequireaccesstofilesthatendwithatilde\)\"][severity\"CRITICAL\"][hostname\"gmint.ch\"][uri\"/.env~\"][unique_id\"avY8--3pi7j37_9Xs-5c6wAAAMU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
tvipper.com
2026-11-12 19:48:45
UTC ·
(13 hours ago)
probing for exposed files and admin pages: 11 attempts within 1 minute, seen by web server log, WAF, fail2ban and CrowdSec (reported by RemotePower)
Web App Attack
2026-11-12 19:24:17
UTC ·
(14 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.18.205.205 (QA/Qatar/205.205.18.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.18.205.205 - - [12/Nov/2026:20:24:13 +01 ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.18.205.205 (QA/Qatar/205.205.18.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.18.205.205 - - [12/Nov/2026:20:24:13 +0100] "GET /.env HTTP/1.1" 406 518
34.18.205.205 - - [12/Nov/2026:20:24:13 +0100] "GET /.env.local HTTP/1.1" 406 6679
34.18.205.205 - - [12/Nov/2026:20:24:14 +0100] "GET /.env.production HTTP/1.1" 406 6679
show less
Port Scan
🇩🇪
yvoictra
2026-11-12 18:15:12
UTC ·
(15 hours ago)
Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-sensitive-files
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 18:03:09
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:03:02.959196 2026] [security2:error] [pid 2273:tid 2 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 13:03:02.959196 2026] [security2:error] [pid 2273:tid 2273] [client 34.18.205.205:53582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmanapps.com"] [uri "/.git/config"] [unique_id "avX_VogqqVdogiEhjphcewAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 17:17:48
UTC ·
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:17:44.540795 2026] [security2:error] [pid 22276:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:17:44.540795 2026] [security2:error] [pid 22276:tid 22276] [client 34.18.205.205:47620] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmacguffin.com"] [uri "/.git/config"] [unique_id "avX0uBS85RqJEQ98OwTj0wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MarkGGN
2026-11-12 12:51:07
UTC ·
(20 hours ago)
Web attack. 34.18.205.205 - - [12/Nov/2026:13:51:06 +0100] "GET /[HOST] HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.18.205.205 - - [12/Nov/2026:13:51:07 +01 ...
show more
Web attack. 34.18.205.205 - - [12/Nov/2026:13:51:06 +0100] "GET /[HOST] HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.18.205.205 - - [12/Nov/2026:13:51:07 +0100] "GET /[HOST] HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Web App Attack
🇫🇷
masterguru
2026-11-12 12:47:33
UTC ·
(20 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇩🇪
rh24
2026-11-12 12:25:56
UTC ·
(21 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.18.205.205 (QA/Qatar/205.205.18.34.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-12 12:24:54
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 07:24:50.256765 2026] [security2:error] [pid 3469:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.18.205.205 (205.205.18.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 07:24:50.256765 2026] [security2:error] [pid 3469:tid 3469] [client 34.18.205.205:39854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "laughingthunder.com"] [uri "/.git/config"] [unique_id "avWwEl4mNu4UQt7zqbKPDAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
