🇺🇸
mnsf
2026-10-12 22:05:46
(1 week ago)
Abuse Detected (21)
Brute-Force
Web App Attack
🇺🇸
ruusvuu
2026-10-12 21:45:06
(1 week ago)
Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US.
Targeted paths: /docker ...
show more
Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US.
Targeted paths: /docker-compose.yml, /docker-compose.yaml, /docker-compose.prod.yml, /docker-compose.production.yml, /config/config.toml.
Sample log lines:
[kit] 34.210.203.187 - - [12/Oct/2026:21:45:05 +0000] "GET /docker-compose.yaml HTTP/1.1" 404 2015 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)"
[kit] 34.210.203.187 - - [12/Oct/2026:21:45:05 +0000] "GET /docker-compose.prod.yml HTTP/1.1" 404 2015 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)"
[kit] 34.210.203.187 - - [12/Oct/2026:21:45:05 +0000] "GET /docker-compose.production.yml HTTP/1.1" 404 2015 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)"
Detected by an automated web-server log monitor.
show less
Web App Attack
🇨🇦
Anytech
2026-10-12 21:31:52
(1 week ago)
Blocked by Conn-Monitor: env-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-12 21:03:05
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.co ...
show more
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 17:02:58.002324 2026] [security2:error] [pid 23442:tid 23442] [client 34.210.203.187:43546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "reelvisionboard.com"] [uri "/.git/config"] [unique_id "as1LAgnmErT5woHPz3oyIwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-10-12 21:00:09
(1 week ago)
Web App Attack
🇹🇭
thaizone.com
2026-10-12 20:46:45
(1 week ago)
Brute Force Attack on a Web Resources (repeated 404) #1
DDoS Attack
Web Spam
Brute-Force
Web App Attack
🇬🇧
KTSTechnology
2026-10-12 20:29:45
(1 week ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 20:10:21
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.co ...
show more
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 16:10:15.207310 2026] [security2:error] [pid 365:tid 365] [client 34.210.203.187:60730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icl1.org"] [uri "/.git/config"] [unique_id "as0-p3A6lSSLu7MEAvtavgAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-12 19:53:10
(1 week ago)
282 requests with url.path *config.toml
157 requests with url.path *config.yml
Brute-Force
Bad Web Bot
🇩🇪
LRob
2026-10-12 19:45:49
(1 week ago)
Technology fingerprinting | method: GET | path: /core/install.php | ua: MerchantSecurityScanner/1.0 ...
show more
Technology fingerprinting | method: GET | path: /core/install.php | ua: MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)
show less
Port Scan
Web App Attack
🇨🇦
polycoda
2026-10-12 19:33:32
(1 week ago)
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 19:32:39
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.co ...
show more
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 15:32:34.993141 2026] [security2:error] [pid 18373:tid 18373] [client 34.210.203.187:41130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "claireashton.com"] [uri "/.git/config"] [unique_id "as010tXWUPR0W4FGEcKwcAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-12 19:25:08
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-10-12 19:05:43
(1 week ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 18:33:33
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.co ...
show more
(mod_security) mod_security (id:210492) triggered by 34.210.203.187 (ec2-34-210-203-187.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 14:33:25.774687 2026] [security2:error] [pid 26827:tid 26848] [client 34.210.203.187:55100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mwcecommerce.com"] [uri "/.git/FETCH_HEAD"] [unique_id "as0n9WM1KUUs4VG5wCTVyQAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
