🇫🇷
SpaceHost-Server
2026-11-09 23:17:49
UTC ·
(19 hours ago)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-09 03:59:27
UTC ·
(1 day ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.21.147.147 - - \[09/Nov/2026:04:59:19 +0100\] "GET /.git/HEAD HTTP/1.1" 302 1535 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 ...
show more
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.21.147.147 - - \[09/Nov/2026:04:59:19 +0100\] "GET /.git/HEAD HTTP/1.1" 302 1535 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-09 02:42:03
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: registry.teddypot.pro | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: registry.teddypot.pro | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇫🇷
SpaceHost-Server
2026-11-08 23:17:07
UTC ·
(1 day ago)
Brute-Force
Web App Attack
🇨🇦
alexbfr
2026-11-08 22:32:07
UTC ·
(1 day ago)
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-08T22:32:07Z; reported_at=2026-11-08T22:32:10Z
2026-11-08T22:32:07Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-08T ...
show more
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-08T22:32:07Z; reported_at=2026-11-08T22:32:10Z
2026-11-08T22:32:07Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-08T22:32:08Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-08T22:32:09Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
show less
Web App Attack
2026-11-08 20:38:12
UTC ·
(1 day ago)
Bot / seems abusive / Apache connections: 84
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-11-08 19:40:06
UTC ·
(1 day ago)
[SunNov0820:39:59.2072902026][security2:error][pid1674540:tid1674612][client34.21.147.147:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\" ...
show more
[SunNov0820:39:59.2072902026][security2:error][pid1674540:tid1674612][client34.21.147.147:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"aidconsultancy.ch\"][uri\"/wp-config.php.bak\"][unique_id\"avDQD08Yc4eRpqxDK9n2fAAAABA\"]
show less
Hacking
Web App Attack
🇩🇪
macrob
2026-11-08 17:20:54
UTC ·
(2 days ago)
2026/11/08 17:20:50 [error] 782864#782864: *16771741 access forbidden by rule, client: 34.21.147.147, server: binixo.pe, request: "GET /.git/HEAD HTTP/2.0", host: "binixo.pe"
2026/11/08 17:20:53 [error] 782863#782863: *16774141 access forbidden by ru ...
show more
2026/11/08 17:20:50 [error] 782864#782864: *16771741 access forbidden by rule, client: 34.21.147.147, server: binixo.pe, request: "GET /.git/HEAD HTTP/2.0", host: "binixo.pe"
2026/11/08 17:20:53 [error] 782863#782863: *16774141 access forbidden by rule, client: 34.21.147.147, server: binixo.pe, request: "GET /.bfrt-1794158452911072059-404 HTTP/2.0", host: "binixo.pe"
2026/11/08 17:20:53 [error] 782862#782862: *16802850 access forbidden by rule, client: 34.21.147.147, server: binixo.pe, request: "GET /.vite/manifest.json HTTP/2.0", host: "binixo.pe"
...
show less
Web App Attack
🇺🇸
WellSpring
2026-11-08 14:53:56
UTC ·
(2 days ago)
env leak on gotahand.org/.env.production — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇩🇪
ghostwarriors
2026-11-08 11:20:08
UTC ·
(2 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
2026-11-08 11:12:53
UTC ·
(2 days ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇩🇪
netman
2026-11-08 11:11:59
UTC ·
(2 days ago)
34.21.147.147 expat-portal.de - [08/Nov/2026:11:10:53 +0000] "GET / HTTP/1.1" 200 217859 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.21.147.147 expat-portal.de - [08/Nov/202 ...
show more
34.21.147.147 expat-portal.de - [08/Nov/2026:11:10:53 +0000] "GET / HTTP/1.1" 200 217859 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.21.147.147 expat-portal.de - [08/Nov/2026:11:11:48 +0000] "GET /robots.txt HTTP/1.1" 200 113 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.21.147.147 expat-portal.de - [08/Nov/2026:11:11:48 +0000] "GET /.git/HEAD HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.21.147.147 expat-portal.de - [08/Nov/2026:11:11:49 +0000] "GET /.git/HEAD HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.21.147.147 expat-portal.de - [08/Nov/2026:11:11:49 +0000] "GET / HTTP/1.1" 200 217859 "${jndi:ldap://127.0.0.1/bifrost-probe}" "Mozilla/5.0 (compatible;
...
show less
DDoS Attack
Web App Attack
🇳🇱
Site.eu
2026-11-08 11:04:50
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 10:45:27
UTC ·
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 34.21.147.147 (147.147.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:45:23.676148 2026] [security2:error] [pid 18085:tid ...
show more
(mod_security) mod_security (id:949110) triggered by 34.21.147.147 (147.147.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:45:23.676148 2026] [security2:error] [pid 18085:tid 18085] [client 34.21.147.147:60978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.cowgirltravel.com"] [uri "/.env"] [unique_id "avBSw-mFjflktKoRX_TcUQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-08 10:14:36
UTC ·
(2 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
