🇫🇷
SpaceHost-Server
2026-11-10 23:18:57
UTC ·
(2 days ago)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-10 23:00:26
UTC ·
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-09.
Web App Attack
SSH
Hacking
🇩🇪
ger-stg-sifi1
2026-11-10 12:05:46
UTC ·
(3 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
masterguru
2026-11-10 10:37:59
UTC ·
(3 days ago)
Potential Remote Command Execution: Log4j / Log4shell. Pattern match "(?i)(?:\\\\$|$?)(?:\\\\{|&l(?:brace|cub);?)(?: (944150-201)
Hacking
🇺🇸
TPI-Abuse
2026-11-10 08:36:24
UTC ·
(3 days ago)
(mod_security) mod_security (id:248270) triggered by 34.186.193.206 (206.193.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:36:18.460679 2026] [security2:error] [pid 14831:ti ...
show more
(mod_security) mod_security (id:248270) triggered by 34.186.193.206 (206.193.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:36:18.460679 2026] [security2:error] [pid 14831:tid 14831] [client 34.186.193.206:18090] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||samirtabet.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "samirtabet.com"] [uri "/"] [unique_id "avLXgq4d9l-dBcCa4zrKgQAAAAQ"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 03:10:36
UTC ·
(3 days ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇳🇱
Alt255
2026-11-10 03:00:39
UTC ·
(3 days ago)
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.186.193.206 - - [10/Nov/2026:04:00:19 +0100] "GET /.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( ...
show more
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.186.193.206 - - [10/Nov/2026:04:00:19 +0100] "GET /.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
lippard2748
2026-11-10 02:42:52
UTC ·
(3 days ago)
22 secrets file requests: /.aws/config, /.aws/credentials, /.docker/config.json, /.git/hooks/post-checkout and 18 more; 2 application exploit path requests: /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-st ...
show more
22 secrets file requests: /.aws/config, /.aws/credentials, /.docker/config.json, /.git/hooks/post-checkout and 18 more; 2 application exploit path requests: /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.... 2026-11-10T02:39:59+00:00 to 2026-11-10T02:42:52+00:00.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:31:14
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.186.193.206 (206.193.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:31:06.886032 2026] [security2:error] [pid 8571:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.186.193.206 (206.193.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:31:06.886032 2026] [security2:error] [pid 8571:tid 8571] [client 34.186.193.206:48892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.360rumors.com"] [uri "/.env"] [unique_id "avKB6pLPaJG_rNQczrCGnQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 02:24:59
UTC ·
(3 days ago)
[web.zebs.ch] httpd-config-scan: sites=zebs.ch; logs=/var/log/httpd/domains/zebs.ch.log; samples=/.env | fast_lane=true kernel_at=2026-11-10T02:23:41+00:00 | requests=1
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-10 02:07:11
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇦🇺
Klaverstyn
2026-11-10 01:41:57
UTC ·
(3 days ago)
Excessive HTTP request rate
Web App Attack
2026-11-10 00:39:52
UTC ·
(3 days ago)
PSCSERV WPSCAN 34.186.193.206
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-10 00:19:44
UTC ·
(3 days ago)
{"level":"info","ts":1794269983.9210331,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.186.193.206","remote_port":"51416","client_ip":"34.186.193.206","proto":"HTTP/1.1","method":"GET","host":"status-arthouse-shows ...
show more
{"level":"info","ts":1794269983.9210331,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.186.193.206","remote_port":"51416","client_ip":"34.186.193.206","proto":"HTTP/1.1","method":"GET","host":"status-arthouse-shows.bitbee-solutions.ch","uri":"/assets/settings.json","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"]}},"bytes_read":0,"user_id":"","duration":0.00008405,"size":0,"status":308,"resp_headers":{"Content-Type":[],"Server":["Caddy"],"Connection":["close"],"Location":["https://status-arthouse-shows.bitbee-solutions.ch/assets/settings.json"]}}
{"level":"info","ts":1794269984.0147636,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.186.193.206","remote_port":"51444","client_ip":"34.186.193.206","proto":"HTTP/1.1","method":"GET","host":"status-arthouse-shows.bitbee-solutions.ch","uri
...
show less
DDoS Attack
Web App Attack
🇬🇧
cg-design.co.uk
2026-11-10 00:07:44
UTC ·
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.186.193.206 (CA/Canada/206.193.186.34.bc.googleusercontent.com)
SQL Injection
