🇵🇱
lns.bz
2026-10-27 15:17:54
(10 hours ago)
Too many 404 requests [BY]
Web App Attack
🇿🇦
conure.sh
2026-10-27 13:10:37
(12 hours ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
🇩🇪
todix
2026-10-27 12:37:20
(13 hours ago)
"GET /.git/config HTTP/1.1" 403 6473 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi ...
show more
"GET /.git/config HTTP/1.1" 403 6473 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Web App Attack
🇭🇺
bcsaba
2026-10-27 12:11:49
(13 hours ago)
P2S/Node.js exploit tester, but noone asked for it
2026/10/27 13:11:46 [error] 1626345#1626345: *798 ...
show more
P2S/Node.js exploit tester, but noone asked for it
2026/10/27 13:11:46 [error] 1626345#1626345: *79800 [client 34.32.31.40] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `55' ) [file "/etc/nginx/modsec/coreruleset-4.30.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 55)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.30.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "*REDACTED*"] [uri "/"] [unique_id "179310310645.994577"] [ref ""], client: 34.32.31.40, server: *REDACTED*, request: "POST / HTTP/1.1", host: "*REDACTED*"
show less
Web App Attack
2026-10-27 11:56:51
(14 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇸🇪
vaia.cloud
2026-10-27 10:20:02
(15 hours ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇨🇿
SystemAdmin
2026-10-27 09:39:07
(16 hours ago)
Doing bad things...
Web App Attack
🇳🇴
jad-abuse
2026-10-27 08:43:37
(17 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_expos ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, source_backup, server_status, wp_admin. Observed by 1 sensor(s); 275 hits.
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 04:49:14
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.32.31.40 (40.31.32.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.31.40 (40.31.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:49:11.549917 2026] [security2:error] [pid 31936:tid 31936] [client 34.32.31.40:53592] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lloydprins.com"] [uri "/.git/config"] [unique_id "auAtR0WkBCgLHPQKvE-cuwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
HerrWolf
2026-10-27 03:45:02
(22 hours ago)
CrowdSec Detection: crowdsecurity/http-admin-interface-probing
Web App Attack
🇪🇸
Francisco Vallejo
2026-10-27 02:57:47
(23 hours ago)
[Tue Oct 27 03:57:47.260461 2026] [authz_core:error] [pid 965114:tid 965162] [client 34.32.31.40:507 ...
show more
[Tue Oct 27 03:57:47.260461 2026] [authz_core:error] [pid 965114:tid 965162] [client 34.32.31.40:50752] AH01630: client denied by server configuration: proxy:http://localhost:3001/
[Tue Oct 27 03:57:47.331691 2026] [authz_core:error] [pid 965114:tid 965164] [client 34.32.31.40:50752] AH01630: client denied by server configuration: proxy:http://localhost:3001/
[Tue Oct 27 03:57:47.385154 2026] [authz_core:error] [pid 965114:tid 965160] [client 34.32.31.40:50752] AH01630: client denied by server configuration: proxy:http://localhost:3001/
[Tue Oct 27 03:57:47.464929 2026] [authz_core:error] [pid 965114:tid 965174] [client 34.32.31.40:50752] AH01630: client denied by server configuration: proxy:http://localhost:3001/
[Tue Oct 27 03:57:47.536042 2026] [authz_core:error] [pid 965114:tid 965168] [client 34.32.31.40:50752] AH01630: client denied by server configuration: proxy:http://localhost:3001/.git/config
...
show less
Brute-Force
SSH
🇩🇪
MBombeck
2026-10-27 02:45:32
(23 hours ago)
Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures
Web App Attack
2026-10-27 02:11:07
(23 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: Word ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 00:38:38
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.31.40 (40.31.32.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.31.40 (40.31.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 20:38:33.288802 2026] [security2:error] [pid 32551:tid 32551] [client 34.32.31.40:35004] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "llew.life"] [uri "/.git/config"] [unique_id "at_yicMJmo9NIxnnfDdUEwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-26 23:53:29
(1 day ago)
Multiple WAF Violations
Web App Attack
