🇧🇷
ICS Labs
2026-11-04 14:36:47
UTC ·
(1 week ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-04 UTC.
Brute-Force
🇺🇸
TPI-Abuse
2026-11-03 19:56:47
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:56:42.663110 2026] [security2:error] [pid 10808:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:56:42.663110 2026] [security2:error] [pid 10808:tid 10808] [client 34.53.158.106:41222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hotpay.co"] [uri "/.git/config"] [unique_id "auo8elgOg7j8dhFKiVwTiQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-03 19:50:04
UTC ·
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
Anonymous
2026-11-03 19:36:01
UTC ·
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-03 19:23:16
UTC ·
(1 week ago)
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /backup/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /backup ...
show more
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /backup/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /backups/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /old/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /tmp/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET /temp/.env HTTP/1.1" 404 511 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.53.158.106 - - [03/Nov/2026:20:23:14 +0100] "GET
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-03 12:25:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:25:05.827876 2026] [security2:error] [pid 19184:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:25:05.827876 2026] [security2:error] [pid 19184:tid 19184] [client 34.53.158.106:50310] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hotjive.com"] [uri "/.git/config"] [unique_id "aunSob_3Y-OqKEuUlNeOwAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-03 12:20:48
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-11-03 10:10:03
UTC ·
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
IVski.com
2026-11-03 08:42:59
UTC ·
(1 week ago)
IVski WAF | Next.js Server Action probe
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:19:55
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:19:48.826929 2026] [security2:error] [pid 16393:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.158.106 (106.158.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:19:48.826929 2026] [security2:error] [pid 16393:tid 16393] [client 34.53.158.106:43078] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "impressionista.net"] [uri "/.git/config"] [unique_id "aumZJC-M80Vuc-c15eSqZgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-03 01:48:39
UTC ·
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack
Anonymous
2026-11-03 00:29:29
UTC ·
(1 week ago)
Aggressive web scan
Web App Attack
🇨🇭
Origon
2026-11-02 23:00:54
UTC ·
(1 week ago)
http-sensitive-files - IP: 34.53.158.106 - time="2026-11-03T00:00:53+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 34.53.158.106 (BE/396982) : 4h ban on Ip 34.53.158.106" ...
show more
http-sensitive-files - IP: 34.53.158.106 - time="2026-11-03T00:00:53+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 34.53.158.106 (BE/396982) : 4h ban on Ip 34.53.158.106" module=db
show less
Web App Attack
Anonymous
2026-11-02 14:03:17
UTC ·
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
Anonymous
2026-11-02 13:47:21
UTC ·
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack