2026-05-19 01:30:45
(1 month ago)
Triggered: repeated knocking on closed ports.
Port Scan
🇫🇷
sthoyer.de
2026-05-19 00:40:42
(1 month ago)
May 19 02:40:39 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ...
show more
May 19 02:40:39 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=34.180.87.24 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x60 TTL=238 ID=4840 PROTO=TCP SPT=51237 DPT=4200 WINDOW=1024 RES=0x00 SYN URGP=0
May 19 02:40:39 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=34.180.87.24 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=7749 PROTO=TCP SPT=51237 DPT=3001 WINDOW=1024 RES=0x00 SYN URGP=0
May 19 02:40:40 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=34.180.87.24 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x60 TTL=239 ID=10414 PROTO=TCP SPT=51237 DPT=8008 WINDOW=1024 RES=0x00 SYN URGP=0
May 19 02:40:40 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=34.180.87.24 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x60 TTL=239 ID=5020 PROTO=TCP SPT=51237 DPT=9000 WINDOW=1024 RES=0x00 SYN
...
show less
Port Scan
🇫🇷
ISPLtd
2026-05-19 00:40:40
(1 month ago)
May 18 21:40:38 34.180.87.24 TCP SPT=51237 DPT=5000 SYN
May 18 21:40:39 34.180.87.24 TCP SPT=51237 D ...
show more
May 18 21:40:38 34.180.87.24 TCP SPT=51237 DPT=5000 SYN
May 18 21:40:39 34.180.87.24 TCP SPT=51237 DPT=7000 SYN
May 18 21:40:39 34.180.87.24 TCP SPT=51237 DPT=8008
...
show less
Port Scan
🇮🇹
bbmmlr
2026-05-18 07:13:00
(1 month ago)
Web App Attack
🇺🇸
octageeks.com
2026-05-16 04:07:13
(1 month ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 10:18:30
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 06:18:25.156051 2026] [security2:error] [pid 4374:tid 4374] [client 34.180.87.24:58280] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crooked1826.org"] [uri "/.git/config"] [unique_id "agby8cMbpN9dPSdpi5pABAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xxkodedxx
2026-05-15 09:15:35
(1 month ago)
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 2× edge-block in 10 ...
show more
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 2× edge-block in 10m window.
Origin: JP / AS396982 Google LLC
Active: 09:15:06→09:15:12 UTC
Volume: 2 HTTP req
Probed: /.git/config
Status mix: 444×2
Vhost fishing: secondopinion.ztx-lab.com
UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Safari/605.1.15"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:52:16
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:52:11.706911 2026] [security2:error] [pid 9679:tid 9679] [client 34.180.87.24:37512] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "silvermoonpizza.com"] [uri "/.git/config"] [unique_id "agbeu3ZFLltZQBYcf3yTzgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Antinson
2026-05-15 07:53:51
(1 month ago)
Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-15 07:51:27
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:51:19.972980 2026] [security2:error] [pid 956:tid 956] [client 34.180.87.24:35624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.redtraffic.media"] [uri "/.git/config"] [unique_id "agbQdzfqxCD5mM4LMmrbugAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 07:29:26
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:29:22.179981 2026] [security2:error] [pid 12513:tid 12513] [client 34.180.87.24:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail-pmg.com"] [uri "/.git/config"] [unique_id "agbLUjs17nhD7J7_PKMTYAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
EDSL
2026-05-15 06:28:02
(1 month ago)
[mail.edsl.fr] Blocked by SysWarden Firewall (Web Attack Port 443)
Web App Attack
Hacking
Port Scan
🇳🇿
Antinson
2026-05-15 04:59:18
(1 month ago)
Scraping with a high error ratio and request rate Requests to unauthorized or suspicious endpoints ( ...
show more
Scraping with a high error ratio and request rate Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-15 04:33:33
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.87.24 (24.87.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 00:33:25.744103 2026] [security2:error] [pid 31292:tid 31292] [client 34.180.87.24:58844] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eb3d.net.lahamradio.com"] [uri "/.git/config"] [unique_id "agaiFUTNTThN4Z1lGIVDwQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-05-15 04:08:16
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 12
Exploited Host
Web App Attack