🇦🇺
Starburst SysOp Team
2026-09-01 14:25:42
(5 hours ago)
Malware host detected by rbl.malware.expert. RBL lookup of 247.42.32.34.rbl.malware.expert succeeded ...
show more
Malware host detected by rbl.malware.expert. RBL lookup of 247.42.32.34.rbl.malware.expert succeeded at REMOTE_ADDR. (400010-syd2-4)
show less
Hacking
🇫🇷
dwmp
2026-09-01 13:22:39
(6 hours ago)
Url probing: /entrance
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-31 22:01:35
(21 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-30.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-08-31 13:41:29
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 09:41:24.884668 2026] [security2:error] [pid 25592:tid 25592] [client 34.32.42.247:35962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.fernandodearatanha.com"] [uri "/.git/config"] [unique_id "apWEhHAPzWZc8jipUMl1qgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-31 12:24:22
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇳🇱
GabrielJST
2026-08-31 12:22:01
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.32.42.247 (DE/Germany/247.42.32.34.b ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.32.42.247 (DE/Germany/247.42.32.34.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
🇳🇱
Eric
2026-08-31 12:03:36
(1 day ago)
[Mon Aug 31 12:03:36.098219 2026] [security2:error] [pid 3121502:tid 3121502] [client 34.32.42.247:3 ...
show more
[Mon Aug 31 12:03:36.098219 2026] [security2:error] [pid 3121502:tid 3121502] [client 34.32.42.247:35086] [client 34.32.42.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.fambus.nl"] [uri "/"] [unique_id "apVtmJRxAu77SvpNigK92AAAABA"]
[Mon Aug 31 12:03:36.146553 2026] [security2:error] [pid 3121502:tid 3121502] [client 34.32.42.247:35086] [client 34.32.42.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 11:18:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 07:18:00.730852 2026] [security2:error] [pid 13239:tid 13239] [client 34.32.42.247:36718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ez1productions.com"] [uri "/.git/config"] [unique_id "apVi6GfzI2D5f4v_GrMhpQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 10:41:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 06:41:13.678746 2026] [security2:error] [pid 30245:tid 30245] [client 34.32.42.247:55154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.exhibitfactory.com"] [uri "/.git/config"] [unique_id "apVaSRrl21UbLKwgZxWvXwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-08-31 10:32:59
(1 day ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 10:05:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 06:05:11.108835 2026] [security2:error] [pid 29557:tid 29557] [client 34.32.42.247:43624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.everpickon.com"] [uri "/.git/config"] [unique_id "apVR1ydqjyDksv69ZMR06gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-08-31 09:47:03
(1 day ago)
34.32.42.247 - - [31/Aug/2026:12:47:02 +0300] "GET /.git/config HTTP/1.1" 403 177 "-" "Mozilla/5.0 ( ...
show more
34.32.42.247 - - [31/Aug/2026:12:47:02 +0300] "GET /.git/config HTTP/1.1" 403 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.247 - - [31/Aug/2026:12:47:02 +0300] "GET /.env.local HTTP/1.1" 403 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇷🇴
iulianh
2026-08-31 09:39:32
(1 day ago)
80,443
Brute-Force
SSH
🇫🇷
Octopuce
2026-08-31 09:37:22
(1 day ago)
Aggressive web search of vulnerable pages: /.env /.env.local /.env.production /.env.staging /.env.de ...
show more
Aggressive web search of vulnerable pages: /.env /.env.local /.env.production /.env.staging /.env.development /.env.test /.env.remote /.env.bak ...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 08:12:45
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.42.247 (247.42.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 04:12:41.663090 2026] [security2:error] [pid 24717:tid 24731] [client 34.32.42.247:39588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ergpd.com"] [uri "/.git/config"] [unique_id "apU3efRJWqkQMsEnukGKHwAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack