๐บ๐ธ
mccsoft.io
2026-10-26 11:02:40
(1 day ago)
Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). So ...
show more
Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). Source matched a blocked-path security rule (jail nginx-444); server returned HTTP 444 (connection closed without response). TCP three-way handshake completed (full HTTP request received).
show less
Bad Web Bot
Web App Attack
๐ฉ๐ช
updown.io
2026-10-26 08:37:18
(1 day ago)
{"level":"info","ts":1793003835.0753622,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1793003835.0753622,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"34.80.51.15","remote_port":"40976","client_ip":"34.80.51.15","proto":"HTTP/2.0","method":"GET","host":"a9an.status.updown.io","uri":"/.env?raw","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"],"Accept":["*/*"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"a9an.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000192577,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1793003835.075
...
show less
DDoS Attack
Web App Attack
๐ซ๐ท
eric-lemesre
2026-10-26 05:06:57
(2 days ago)
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:04: ...
show more
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:04:12 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:06:56 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:06:56 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:06:57 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:06:57 +0100] "-" 400 150 "-" "-"
34.80.51.15 - - [26/Oct/2026:06:06:57 +0100] "-" 400 150 "-" "-"
...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-26 00:11:50
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.80.51.15 (15.51.80.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.80.51.15 (15.51.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 20:11:46.241887 2026] [security2:error] [pid 2761:tid 2761] [client 34.80.51.15:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.marshallcurry.com|F|2"] [data ".marshallcurry.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.marshallcurry.com"] [uri "/z9x8c7v6b5-debug-trigger-autodiscover.marshallcurry.com"] [unique_id "at6awpMo7lgMVxyFeQ3bAwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Site.eu
2026-10-25 22:03:26
(2 days ago)
Excessive 404/403 errors
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-10-25 16:57:10
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.80.51.15 (15.51.80.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.51.15 (15.51.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:57:06.781091 2026] [security2:error] [pid 20050:tid 20050] [client 34.80.51.15:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.mail-pmg.com"] [uri "/.env.supabase"] [unique_id "at404tLFTHMY_RYfJBvE-gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ธ๐ฌ
Cloudkul Cloudkul
2026-10-25 09:48:24
(2 days ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
๐ซ๐ฎ
Christopher Hughes
2026-10-25 09:46:22
(2 days ago)
34.80.51.15 - - [25/Oct/2026:09:46:21 +0000] "GET /_astro/pages/index.astro.mjs.map HTTP/2.0" 401 41 ...
show more
34.80.51.15 - - [25/Oct/2026:09:46:21 +0000] "GET /_astro/pages/index.astro.mjs.map HTTP/2.0" 401 410 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
๐ซ๐ฎ
Christopher Hughes
2026-10-25 09:14:48
(2 days ago)
34.80.51.15 - - [25/Oct/2026:09:14:48 +0000] "GET /sitemap_index.xml HTTP/2.0" 401 433 "-" "Mozilla/ ...
show more
34.80.51.15 - - [25/Oct/2026:09:14:48 +0000] "GET /sitemap_index.xml HTTP/2.0" 401 433 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
๐ณ๐ฑ
Alt255
2026-10-25 07:35:59
(3 days ago)
[ti-22al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-22al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.80.51.15 - - [25/Oct/2026:08:35:30 +0100] "GET /wp-sitemap.xml HTTP/2.0" 404 61837 "https://community.dutchtallship.com/sitemap.xml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
34.80.51.15 - - [25/Oct/2026:08:35:35 +0100] "GET /dist/.vite/manifest.json HTTP/2.0" 404 61726 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.80.51.15 - - [25/Oct/2026:08:35:35 +0100] "GET /dz2yw1bboyaysi4gyo76 HTTP/2.0" 404 61673 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.80.51.15 - -
...
show less
Bad Web Bot
Web App Attack
๐ซ๐ฎ
Christopher Hughes
2026-10-25 07:10:19
(3 days ago)
34.80.51.15 - - [25/Oct/2026:07:10:19 +0000] "GET /supabase/config.toml HTTP/2.0" 401 410 "-" "Mozil ...
show more
34.80.51.15 - - [25/Oct/2026:07:10:19 +0000] "GET /supabase/config.toml HTTP/2.0" 401 410 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
๐ซ๐ฎ
Christopher Hughes
2026-10-25 06:29:36
(3 days ago)
34.80.51.15 - - [25/Oct/2026:06:29:34 +0000] "GET /z9x8c7v6b5-debug-trigger-cms.tmxnews.co.uk HTTP/2 ...
show more
34.80.51.15 - - [25/Oct/2026:06:29:34 +0000] "GET /z9x8c7v6b5-debug-trigger-cms.tmxnews.co.uk HTTP/2.0" 401 410 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
๐ซ๐ฎ
Christopher Hughes
2026-10-25 06:04:24
(3 days ago)
34.80.51.15 - - [25/Oct/2026:06:04:24 +0000] "GET /__vite_rsc_findSourceMapURL?filename=file:///proc ...
show more
34.80.51.15 - - [25/Oct/2026:06:04:24 +0000] "GET /__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ&environmentName=rsc HTTP/2.0" 401 410 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
๐ฌ๐ง
Marten Mark
2026-10-25 05:53:05
(3 days ago)
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.aws/credentials HTTP/2.0" 404 1449 "-" "Mozilla/ ...
show more
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.aws/credentials HTTP/2.0" 404 1449 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.env.supabase HTTP/2.0" 404 1449 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.env.supabase HTTP/2.0" 404 1449 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.aws/config HTTP/2.0" 404 1449 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
34.80.51.15 - - [25/Oct/2026:05:53:01 +0000] "GET /.aws/config HTTP/2.0" 404 1449 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
34.80.51.15 - - [25/Oct/2026:05:53:02 +000
...
show less
Port Scan
Web App Attack
๐ต๐ฑ
bmino.pl
2026-10-25 05:52:27
(3 days ago)
Autoban IP(2): 34.80.51.15 - Hostname: Google LLC - City: Taipei - Country: Taiwan - Organization: G ...
show more
Autoban IP(2): 34.80.51.15 - Hostname: Google LLC - City: Taipei - Country: Taiwan - Organization: Google Cloud (asia-east1) - Reason: GET /docker/.env HTTP/2.0
show less
Web App Attack