2026-11-09 01:02:35
UTC ·
(15 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-path-traversal-probing; Action=ban; Events=4; Hosts=portal.incognet.io; Paths=/css../.env,/js../.env,/media../.env,/public../.env; Country=TW; ASN=396982 GOOGLE-CLOUD-PLATFORM
Port Scan
Web App Attack
2026-11-09 00:04:07
UTC ·
(16 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-sensitive-files; Action=ban; Events=5; Hosts=portal.incognet.io; Paths=/assets../.env,/css../.env,/js../.env,/media../.env,/public../.env; Country=TW; ASN=396982 GOOGLE-CLOUD-PLATFORM
Hacking
Web App Attack
2026-11-08 23:01:48
UTC ·
(17 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-crawl-non_statics; Action=ban; Events=56; Hosts=portal.incognet.io; Paths=/.git-credentials,/.github/workflows/deploy.yml,/.gitlab-ci.yml,/firebase-adminsdk.json,/key.json,/serviceAcco ...
show more
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-crawl-non_statics; Action=ban; Events=56; Hosts=portal.incognet.io; Paths=/.git-credentials,/.github/workflows/deploy.yml,/.gitlab-ci.yml,/firebase-adminsdk.json,/key.json,/serviceAccountKey.json; Country=TW; ASN=396982 GOOGLE-CLOUD-PLATFORM
show less
Bad Web Bot
🇫🇮
Some Body
2026-11-08 22:47:53
UTC ·
(17 hours ago)
Aggressive web scan
Brute-Force
Web App Attack
🇹🇼
tyetriiix
2026-11-08 20:03:52
UTC ·
(20 hours ago)
Wazuh Alert Evidence: 2026/11/08 20:03:49 [error] 2935603#2935603: *6093 access forbidden by rule, client: 34.80.189.71, server: dev.triiix.io, request: "GET / HTTP/2.0", host: "dev.triiix.io"
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:17:01
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.80.189.71 (71.189.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:16:56.444006 2026] [security2:error] [pid 5359:tid 537 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.189.71 (71.189.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:16:56.444006 2026] [security2:error] [pid 5359:tid 5375] [client 34.80.189.71:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.humanet.io"] [uri "/.env.docker"] [unique_id "avC8mH3yl__YotnQXvI39gAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
33three
2026-11-08 18:16:38
UTC ·
(22 hours ago)
Fail2Ban jail WebAttack triggered
Brute-Force
🇮🇹
VHosting
2026-11-08 17:35:03
UTC ·
(22 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
security.rdmc.fr
2026-11-08 17:02:20
UTC ·
(23 hours ago)
Web scan: many distinct 4xx paths
Web App Attack
Bad Web Bot
🇳🇱
Savvii
2026-11-08 15:43:31
UTC ·
(1 day ago)
20 attempts against mh-misbehave-ban on cold
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
eric-lemesre
2026-11-08 14:40:07
UTC ·
(1 day ago)
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 40 ...
show more
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:36:29 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:40:06 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:40:06 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:40:06 +0100] "-" 400 150 "-" "-"
34.80.189.71 - - [08/Nov/2026:15:40:06 +0100] "-" 400 150 "-" "-"
...
show less
Web App Attack
🇩🇪
updown.io
2026-11-08 14:30:57
UTC ·
(1 day ago)
{"level":"info","ts":1794148256.4199374,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.80.189.71","remote_port":"55780","client_ip":"34.80.189.71","proto":"HTTP/2.0","method":"GET","host":"status.pdfmonkey.io","uri ...
show more
{"level":"info","ts":1794148256.4199374,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.80.189.71","remote_port":"55780","client_ip":"34.80.189.71","proto":"HTTP/2.0","method":"GET","host":"status.pdfmonkey.io","uri":"/organization","headers":{"Priority":["u=0, i"],"Sec-Ch-Ua-Platform":["\"Android\""],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Site":["none"],"Sec-Ch-Ua-Mobile":["?1"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-User":["?1"],"Cookie":["REDACTED"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Microsoft Edge\";v=\"152\""]},"tls":{"resumed":false,"version":772,"cipher_sui
...
show less
DDoS Attack
Web App Attack
2026-11-08 14:30:06
UTC ·
(1 day ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
