🇺🇸
TPI-Abuse
2026-09-18 08:18:14
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.39.153.7 (7.153.39.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.153.7 (7.153.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 04:18:06.349634 2026] [security2:error] [pid 15621:tid 15621] [client 34.39.153.7:38516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paulbihn.com"] [uri "/.git/config"] [unique_id "aqzzvoN9GqZR0haRy53g1AAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-18 07:27:24
(1 week ago)
Malicious Probing
Bad Web Bot
🇫🇷
masterguru
2026-09-18 07:02:42
(1 week ago)
Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b ...
show more
Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b (932235-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-18 00:23:29
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.39.153.7 (7.153.39.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.153.7 (7.153.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 20:23:21.837362 2026] [security2:error] [pid 16521:tid 16521] [client 34.39.153.7:38874] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pcga.golf"] [uri "/.git/config"] [unique_id "aqyEeXHo6KMezJP6vlLfCgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-17 23:24:01
(1 week ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.39.153.7 - - [18/Sep/2026:01:23:58 +0200] "GET /.git/config HTTP/1.1" 301 494 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-17 22:42:37
(1 week ago)
Excessive 404/403 errors
Brute-Force
🇦🇺
2000cn.com.au
2026-09-17 21:45:24
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇱
Site.eu
2026-09-17 19:58:58
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
webanyone
2026-09-17 17:16:48
(1 week ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-17 14:30:02
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
Hazzard
2026-09-17 12:20:18
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇧🇬
HighWay
2026-09-17 10:46:51
(1 week ago)
34.39.153.7 - - [17/Sep/2026:10:46:44 +0000] "GET /phpinfo.php HTTP/1.1" 404 5566 "-" "Mozilla/5.0 ( ...
show more
34.39.153.7 - - [17/Sep/2026:10:46:44 +0000] "GET /phpinfo.php HTTP/1.1" 404 5566 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.39.153.7 - - [17/Sep/2026:10:46:44 +0000] "GET /info.php HTTP/1.1" 404 469 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.39.153.7 - - [17/Sep/2026:10:46:45 +0000] "GET /php.php HTTP/1.1" 404 468 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.39.153.7 - - [17/Sep/2026:10:46:45 +0000] "GET /i.php HTTP/1.1" 404 466 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.39.153.7 - - [17/Sep/2026:10:46:45 +0000] "GET /pi.php HTTP/1.1" 404 467 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.39.153.7 - - [17/Sep/2026:10:46:45 +0000] "GET /pinfo.php HTTP/1.1" 4
...
show less
Bad Web Bot
Web App Attack
🇫🇷
phoenix1jl96
2026-09-17 10:35:09
(1 week ago)
2026/09/17 12:35:08 [error] 2062778#2062778: *54011 open() "/home/user-data/www/default/mailer/.env" ...
show more
2026/09/17 12:35:08 [error] 2062778#2062778: *54011 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.39.153.7, server: pbs.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "pbs.ledemon.us"
2026/09/17 12:35:08 [error] 2062778#2062778: *54011 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.39.153.7, server: pbs.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "pbs.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇩🇪
LRob
2026-09-17 10:15:19
(1 week ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.git/config (+4 more) | 2026-09-17 10:15 UTC
show less
Hacking
Web App Attack
2026-09-17 09:49:40
(1 week ago)
Flagged as abuse by IisGuard automated detection (tier L3, score 65/100). Reasons: Reputation=1, Bad ...
show more
Flagged as abuse by IisGuard automated detection (tier L3, score 65/100). Reasons: Reputation=1, BadPath=23,9, Rate=20, Diversity=20.
show less
Web App Attack
DDoS Attack
Bad Web Bot