🇺🇸
TPI-Abuse
2026-11-14 09:58:09
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:58:01.975242 2026] [security2:error] [pid 434:tid 43 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:58:01.975242 2026] [security2:error] [pid 434:tid 434] [client 34.40.199.221:51696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "preskitpc.com"] [uri "/.git/config"] [unique_id "avgwqWPMsQxqbpox0My2ZwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-13 23:01:06
UTC ·
(17 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-11-13 12:07:40
UTC ·
(1 day ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 1 domain(s) in 7s
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-12 23:01:19
UTC ·
(1 day ago)
Auto-ban: >3000 req/min op 2026-11-12
Web App Attack
SSH
Hacking
🇸🇪
vaia.cloud
2026-11-12 21:00:04
UTC ·
(1 day ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-11-12 19:28:47
UTC ·
(1 day ago)
csagent: score 20.4: 404 noise floor x2, secrets grab x2; 1 domain(s) in 7s
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-11-12 19:26:22
UTC ·
(1 day ago)
2026/11/12 19:26:08 [error] 3020#3020: *320540 access forbidden by rule, client: 34.40.199.221, server: centroestudostibetanos.org, request: "GET /.env HTTP/1.1", host: "nalanda.centroestudostibetanos.org"
34.40.199.221 - - [12/Nov/2026:19:26:08 +000 ...
show more
2026/11/12 19:26:08 [error] 3020#3020: *320540 access forbidden by rule, client: 34.40.199.221, server: centroestudostibetanos.org, request: "GET /.env HTTP/1.1", host: "nalanda.centroestudostibetanos.org"
34.40.199.221 - - [12/Nov/2026:19:26:08 +0000] "GET /.env HTTP/1.1" 403 1057 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
2026/11/12 19:26:20 [error] 3020#3020: *320540 access forbidden by rule, client: 34.40.199.221, server: centroestudostibetanos.org, request: "GET /app/.env HTTP/1.1", host: "nalanda.centroestudostibetanos.org"
show less
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-11-12 18:30:08
UTC ·
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 17:09:14
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:09:09.749793 2026] [security2:error] [pid 14758:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:09:09.749793 2026] [security2:error] [pid 14758:tid 14758] [client 34.40.199.221:55646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nakedtyro.com"] [uri "/.git/config"] [unique_id "avXytYNEbb1XKO_rLI_0XgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-12 15:37:10
UTC ·
(2 days ago)
478 requests with url.path *.env
Brute-Force
Bad Web Bot
2026-11-12 13:59:16
UTC ·
(2 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-12 13:06:49
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:06:44.649609 2026] [security2:error] [pid 1418:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.199.221 (221.199.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:06:44.649609 2026] [security2:error] [pid 1418:tid 1418] [client 34.40.199.221:54406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "petrovic4.com"] [uri "/.git/config"] [unique_id "avW55Oi0W9gmcdtpMM9-6AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 12:10:07
UTC ·
(2 days ago)
| [Dangerous/Australia] Aggressive IP 34.40.199.221 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
2026-11-12 11:59:33
UTC ·
(2 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-12 11:55:06
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
