🇳🇱
Site.eu
2026-10-13 15:07:42
(3 days ago)
Excessive multi-domain requests
Brute-Force
2026-10-11 01:07:05
(6 days ago)
Automated web scanner. Requested suspicious paths: /dist/.vite/manifest.json | /dist/manifest.json | ...
show more
Automated web scanner. Requested suspicious paths: /dist/.vite/manifest.json | /dist/manifest.json | /.vite/manifest.json | /build/manifest.json. UTC: 2026-10-11 00:18:30.
show less
Web App Attack
🇬🇧
andypiper
2026-10-11 01:01:06
(6 days ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
2026-10-11 00:15:15
(6 days ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇸🇪
vaia.cloud
2026-10-11 00:05:13
(6 days ago)
crowdsecurity/http-cve-2021-41773
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 23:56:53
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.39.218.232 (232.218.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.218.232 (232.218.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 19:56:50.168354 2026] [security2:error] [pid 23492:tid 23503] [client 34.39.218.232:42304] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oplconnect.com"] [uri "/app/.env"] [unique_id "asrQwrnhJYhYI7xpEBsolgAAAYg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Stara
2026-10-10 23:17:06
(6 days ago)
ModSecurity detected web attack - .env/config probing or SQLi/Code injection (Rule 949110)
Brute-Force
Hacking
Web App Attack
🇨🇭
zynex
2026-10-10 23:11:25
(6 days ago)
URL Probing: /@fs/app/.env
Web App Attack
2026-10-10 23:02:57
(6 days ago)
34.39.218.232 - - [11/Oct/2026:07:02:55 +0800] "GET /@fs/../.env?raw?? HTTP/2.0" 403 564 "-" "Mozill ...
show more
34.39.218.232 - - [11/Oct/2026:07:02:55 +0800] "GET /@fs/../.env?raw?? HTTP/2.0" 403 564 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-10 22:11:28
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.39.218.232 (232.218.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.218.232 (232.218.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 18:11:20.764633 2026] [security2:error] [pid 11534:tid 11534] [client 34.39.218.232:49482] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||miszewski.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "miszewski.com"] [uri "/z9x8c7v6b5-debug-trigger-miszewski.com"] [unique_id "asq4CPpXdFzk3d955DdrPAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-10 21:45:07
(6 days ago)
34.39.218.232 - - [11/Oct/2026:00:45:05 +0300] "GET /firebase-adminsdk.json HTTP/2.0" 404 201 "-" "M ...
show more
34.39.218.232 - - [11/Oct/2026:00:45:05 +0300] "GET /firebase-adminsdk.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.39.218.232 - - [11/Oct/2026:00:45:07 +0300] "GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/2.0" 404 201 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 21:44:21
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.39.218.232 (232.218.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.218.232 (232.218.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 17:44:13.726822 2026] [security2:error] [pid 5969:tid 5985] [client 34.39.218.232:47804] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mirrorsimage.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mirrorsimage.com"] [uri "/z9x8c7v6b5-debug-trigger-mirrorsimage.com"] [unique_id "asqxrTAbV-14Vu27pbp-BwAAAQ8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ruusvuu
2026-10-10 21:43:10
(6 days ago)
Automated abuse report: 25 attack/probe requests from Google LLC / BR.
Targeted paths: /api/proc/sel ...
show more
Automated abuse report: 25 attack/probe requests from Google LLC / BR.
Targeted paths: /api/proc/self/environ, /proc/self/cmdline, /cache/.env, /.env, /var/run/secrets/kubernetes.io/serviceaccount/token.
Sample log lines:
[mir-com] [10/10/2026, 2:43:09 PM] GET .mirregistry.com/.dockerenv 429 34.39.218.232 - 5.226 ms
[mir-com] [10/10/2026, 2:43:09 PM] GET .mirregistry.com/proc/self/cgroup 429 34.39.218.232 - 4.674 ms
[mir-com] [10/10/2026, 2:43:09 PM] GET .mirregistry.com/google-credentials.json 429 34.39.218.232 - 5.005 ms
Detected by an automated web-server log monitor.
show less
Web App Attack
2026-10-10 21:30:03
(6 days ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇨🇦
Dunham Support
2026-10-10 21:19:40
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.39.218.232 (BR/Brazil/232.218.39.34. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.39.218.232 (BR/Brazil/232.218.39.34.bc.googleusercontent.com)
show less
SQL Injection