🇬🇧
consul.to
2026-10-19 00:22:45
UTC ·
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
thesimonmanuel
2026-10-18 23:55:09
UTC ·
(3 weeks ago)
34.24.112.172 - - [19/Oct/2026:05:25:08 +0530] "GET /.env.production.local HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" "34.24.112.172"
Web App Attack
🇺🇸
kosada.com
2026-10-18 23:13:01
UTC ·
(3 weeks ago)
Repeated exploit attempts, for example: /build/.env /.env (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)")
Web App Attack
🇳🇱
Savvii
2026-10-18 23:11:05
UTC ·
(3 weeks ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 21:15:56
UTC ·
(3 weeks ago)
Date: 2026/10/19 06 15 56
URI: http://adelabelly.com/.env
Web App Attack
🇲🇾
Rizzy
2026-10-18 20:25:12
UTC ·
(3 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-18 20:05:54
UTC ·
(3 weeks ago)
[ti-07al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.24.112.172 - - [18/Oct/2026:22:05:35 +0200] "GET /asset-manifest.json HTTP/1.1" 404 2050 "-" "Mozilla/5.0 (Linux; Android 10; K) A ...
show more
[ti-07al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.24.112.172 - - [18/Oct/2026:22:05:35 +0200] "GET /asset-manifest.json HTTP/1.1" 404 2050 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
34.24.112.172 - - [18/Oct/2026:22:05:35 +0200] "GET /dist/manifest.json HTTP/1.1" 404 2050 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
34.24.112.172 - - [18/Oct/2026:22:05:35 +0200] "GET /static/manifest.json HTTP/1.1" 404 7399 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
34.24.112.172 - - [18/Oct/2026:22:05:35 +0200] "GET /manifest.json HTTP/1.1" 404 7399 "-" "Mozilla/5.0 (Li
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-10-18 16:30:12
UTC ·
(3 weeks ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 15:25:38
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.24.112.172 (172.112.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:25:34.313038 2026] [security2:error] [pid 2573:tid 2 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.24.112.172 (172.112.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:25:34.313038 2026] [security2:error] [pid 2573:tid 2602] [client 34.24.112.172:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.mindgardens.com|F|2"] [data ".mindgardens.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.mindgardens.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.mindgardens.com"] [unique_id "atTk7l2JcHPpD5sFXSgziwAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 13:59:38
UTC ·
(3 weeks ago)
Scan for .env Files at 2026-10-18T13:59:38+00:00
Web App Attack
🇺🇸
wordpresshosting.solutions
2026-10-18 13:54:40
UTC ·
(3 weeks ago)
Web brute-force / failed auth detected. Evidence: [Sun Oct 18 13:54:39.579157 2026] [authz_core:error] [pid 239016] [client [IP]:0] AH01630: client [IP]nied by server configuration: proxy:http://[IP]:18081/dist/.vite/manifest.json
[Sun Oct 18 13:54:3 ...
show more
Web brute-force / failed auth detected. Evidence: [Sun Oct 18 13:54:39.579157 2026] [authz_core:error] [pid 239016] [client [IP]:0] AH01630: client [IP]nied by server configuration: proxy:http://[IP]:18081/dist/.vite/manifest.json
[Sun Oct 18 13:54:39.600880 2026] [authz_core:error] [pid 1855] [client [IP]:0] AH01630: client [IP]nied by server configuration: proxy:http://[IP]:18081/.vite/manifest.json
show less
Brute-Force
Web App Attack
🇵🇱
gandaflux
2026-10-18 12:16:32
UTC ·
(3 weeks ago)
34.24.112.172 [redacted-domain] - [18/Oct/2026:14:16:31 +0200] "GET /.gitlab-ci.yml HTTP/2.0" 403 158 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [redacted-email])"
34.24.112.172 [redacted-domain] - [18/Oct/2026 ...
show more
34.24.112.172 [redacted-domain] - [18/Oct/2026:14:16:31 +0200] "GET /.gitlab-ci.yml HTTP/2.0" 403 158 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [redacted-email])"
34.24.112.172 [redacted-domain] - [18/Oct/2026:14:16:31 +0200] "GET /assets../.env HTTP/2.0" 403 158 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +[redacted-url]/)"
34.24.112.172 [redacted-domain] - [18/Oct/2026:14:16:31 +0200] "GET /images../.env HTTP/2.0" 403 158 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +[redacted-url]/)"
show less
Web App Attack
🇩🇪
updown.io
2026-10-18 10:25:23
UTC ·
(3 weeks ago)
{"level":"info","ts":1792319121.7172325,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.24.112.172","remote_port":"36586","client_ip":"34.24.112.172","proto":"HTTP/2.0","method":"GET","host":"status.milouvanham.nl", ...
show more
{"level":"info","ts":1792319121.7172325,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.24.112.172","remote_port":"36586","client_ip":"34.24.112.172","proto":"HTTP/2.0","method":"GET","host":"status.milouvanham.nl","uri":"/static/..;/..;/..;/..;/proc/self/environ","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["CCBot/2.0 (https://commoncrawl.org/faq/)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.milouvanham.nl","ech":false}},"bytes_read":0,"user_id":"","duration":0.000876784,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1792319121.719001,"logger":"http.log.acce
...
show less
DDoS Attack
Web App Attack
🇫🇷
masterguru
2026-10-18 09:09:29
UTC ·
(3 weeks ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-196)
show less
Hacking
🇩🇪
thesimonmanuel
2026-10-18 08:27:44
UTC ·
(3 weeks ago)
34.24.112.172 - - [18/Oct/2026:13:57:43 +0530] "GET /images../.env HTTP/2.0" 403 106 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" "-"
Web App Attack
