🇳🇱
middelkoopcc
2026-09-09 23:26:01
(1 month ago)
2026-09-10 01:23:17 GET /.aider.model.settings.yml [404] && 2026-09-10 01:23:17 GET /info.php [404] ...
show more
2026-09-10 01:23:17 GET /.aider.model.settings.yml [404] && 2026-09-10 01:23:17 GET /info.php [404] && 2026-09-10 01:23:17 GET /.secrets.json [404] && 115 more within 20 minutes
show less
Web App Attack
🇦🇺
screwlooseit.com.au
2026-09-08 17:44:28
(1 month ago)
Blocked by CSF 13 firewall - Rule: US/United States/157.18.30.34.bc.googleusercontent.com
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-07 22:01:35
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-06.
show less
Web App Attack
SSH
Hacking
🇪🇸
alferez
2026-09-06 20:18:06
(1 month ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-09-06 12:47:05
(1 month ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-06 04:20:44
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 00:20:38.914709 2026] [security2:error] [pid 9838:tid 9838] [client 34.30.18.157:37838] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||buffalogunsaz.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "buffalogunsaz.com"] [uri "/dump.sql"] [unique_id "apzqFl_tkQBFsu_swWUZCgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-06 04:01:56
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
BlueWire Hosting
2026-09-06 02:01:16
(1 month ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
🇺🇸
TPI-Abuse
2026-09-06 00:48:15
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:48:07.848855 2026] [security2:error] [pid 32362:tid 32362] [client 34.30.18.157:46590] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||assholesanonymous.onlyincanada-eh.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "assholesanonymous.onlyincanada-eh.com"] [uri "/backup.sql"] [unique_id "apy4R99z-ell35ugVotIBgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-06 00:23:13
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
2026-09-05 21:27:54
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇧🇪
cmbplf
2026-08-07 21:58:58
(2 months ago)
120 requests with url.path */auth.json
Brute-Force
Bad Web Bot
🇪🇸
pipeline.es
2026-08-07 20:27:22
(2 months ago)
Web scanning / probing for vulnerable paths | URL: /auth.json | Evidence: morgana.travel 34.30.18.15 ...
show more
Web scanning / probing for vulnerable paths | URL: /auth.json | Evidence: morgana.travel 34.30.18.157 - - [07/Aug/2026:22:25:11 +0200] \"GET /auth.json HTTP/1.1\" 404 207 \"https://www.morgana.travel/auth.json\" \"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user\" GEOIP_COUNTRY_CODE=US | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 20:26:26
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 16:26:18.331549 2026] [security2:error] [pid 8569:tid 8569] [client 34.30.18.157:46014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.emea.legal"] [uri "/.git/config"] [unique_id "anY_atlmeUyaJcPp1rvuiwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 20:03:22
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.30.18.157 (157.18.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 16:03:17.923865 2026] [security2:error] [pid 2202891:tid 2202891] [client 34.30.18.157:40062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dci.legal"] [uri "/.env.backup"] [unique_id "anY6BajWh1jNtdaVy4obwwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
