Anonymous
2026-08-12 04:32:45
UTC ·
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇳🇱
homeshowdomain.nl
2026-08-11 22:00:26
UTC ·
(3 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-10.
Web App Attack
SSH
Hacking
🇳🇱
Site.eu
2026-08-11 09:30:28
UTC ·
(3 months ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
andypiper
2026-08-11 01:02:59
UTC ·
(3 months ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-08-11 00:09:35
UTC ·
(3 months ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇺🇸
bigscoots.com
2026-08-10 22:54:26
UTC ·
(3 months ago)
(PERMBLOCK) 34.84.10.130 (130.10.84.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-10 22:16:37
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 18:16:32.389081 2026] [security2:error] [pid 25257:tid 25 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 18:16:32.389081 2026] [security2:error] [pid 25257:tid 25257] [client 34.84.10.130:55738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.southtncardio.com"] [uri "/static../.env"] [unique_id "anpNwOC1AZJLOBYDx4k3OwAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 21:42:55
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:42:49.890761 2026] [security2:error] [pid 3810530:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:42:49.890761 2026] [security2:error] [pid 3810530:tid 3810545] [client 34.84.10.130:8684] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.joshuapaulweckesser.com"] [uri "/static../.env"] [unique_id "anpF2UKdvPkXRKUx8McCiAAAAUA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 21:07:05
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:06:57.680658 2026] [security2:error] [pid 3290716:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:06:57.680658 2026] [security2:error] [pid 3290716:tid 3290716] [client 34.84.10.130:59590] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.hotelkona.com"] [uri "/.env"] [unique_id "ano9cdvvhzIHHN6-yHpYnAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-08-10 21:05:03
UTC ·
(3 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇺🇸
TAY
2026-08-10 20:46:45
UTC ·
(3 months ago)
34.84.10.130 - - [11/Aug/2026:04:46:42 +0800] "GET /assets../../../etc/passwd HTTP/1.1" 400 7823 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.84.10.130 - - [11/Aug/2026:04:46:42 +0800] "GET /files../etc/p ...
show more
34.84.10.130 - - [11/Aug/2026:04:46:42 +0800] "GET /assets../../../etc/passwd HTTP/1.1" 400 7823 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.84.10.130 - - [11/Aug/2026:04:46:42 +0800] "GET /files../etc/passwd HTTP/1.1" 404 48498 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)"
34.84.10.130 - - [11/Aug/2026:04:46:42 +0800] "GET /static../etc/passwd HTTP/1.1" 404 48498 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
...
show less
Brute-Force
🇩🇪
Hazzard
2026-08-10 20:41:30
UTC ·
(3 months ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
NetVexor
2026-08-10 20:22:52
UTC ·
(3 months ago)
Attack source identified and submitted via NetVexor BGP Blackhole Network
Port Scan
Hacking
Brute-Force
🇸🇪
vaia.cloud
2026-08-10 19:55:02
UTC ·
(3 months ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-10 19:54:52
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 15:54:46.449843 2026] [security2:error] [pid 4122076:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.10.130 (130.10.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 15:54:46.449843 2026] [security2:error] [pid 4122076:tid 4122076] [client 34.84.10.130:52606] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.theopinionatedowl.com"] [uri "/.env"] [unique_id "anosho8ViitUmd70sjvAAAAAADo"]
show less
Brute-Force
Bad Web Bot
Web App Attack