2026-09-17 08:25:01
(10 minutes ago)
suspicious request in access.log
Web App Attack
2026-09-17 07:39:05
(56 minutes ago)
Web application attack detected.
Web App Attack
🇺🇸
infra-monitor
2026-09-17 03:00:05
(5 hours ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan
🇺🇸
TPI-Abuse
2026-09-17 02:46:56
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:46:50.997884 2026] [security2:error] [pid 11108:tid 11108] [client 34.65.74.250:53946] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "synercom.org"] [uri "/.git/config"] [unique_id "aqtUmkF1YJ4noULGwmduoAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
AvonleaConsulting
2026-09-16 17:17:42
(15 hours ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
🇩🇪
Petros Stefanakis
2026-09-16 16:53:20
(15 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.65.74.250 (CH/Switzerland/250.74.65. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.65.74.250 (CH/Switzerland/250.74.65.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-09-16 15:44:02
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 11:43:56.115994 2026] [security2:error] [pid 3151:tid 3151] [client 34.65.74.250:55088] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shellyfamily.com"] [uri "/.git/config"] [unique_id "aqq5PC7NylIQGYgm1_odJwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
leo1305
2026-09-16 15:17:09
(17 hours ago)
CrowdSec detection | scenario: http-sensitive-files
Web App Attack
Exploited Host
🇨🇦
polycoda
2026-09-16 15:15:56
(17 hours ago)
🔥 VERY AGGRESSIVE SCANNER probed over 300 inexistent files and PHP scripts in less than an hour.
Hacking
Web App Attack
🇳🇱
Savvii
2026-09-16 15:12:40
(17 hours ago)
15 attempts against mh-modsecurity-ban on shelf
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 15:03:38
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 11:03:34.024555 2026] [security2:error] [pid 3325:tid 3325] [client 34.65.74.250:43210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shelbynash.com"] [uri "/.git/config"] [unique_id "aqqvxstt-AtLcxfgD1a-IwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-09-16 14:22:07
(18 hours ago)
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based ...
show more
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 13:33:35
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.65.74.250 (250.74.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 09:33:27.290414 2026] [security2:error] [pid 14357:tid 14357] [client 34.65.74.250:52068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sheamar.com"] [uri "/.git/config"] [unique_id "aqqap6PMvnKfA7eg8MP-bwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
legionMCCXV
2026-09-16 07:10:53
(1 day ago)
PHP/WordPress shell scanner on non-PHP site — repeated requests to .php paths returning 404.
Bad Web Bot
🇩🇪
pltcldvlpr
2026-09-16 06:48:27
(1 day ago)
CMS/framework probe: 34.65.74.250 - - [16/Sep/2026:08:48:27 +0200] "GET /.git/config HTTP/1.1" 404 5 ...
show more
CMS/framework probe: 34.65.74.250 - - [16/Sep/2026:08:48:27 +0200] "GET /.git/config HTTP/1.1" 404 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" asn=396982 org="Google LLC" country=CH
...
show less
Web App Attack