🇩🇪
MBombeck
2026-09-13 06:01:36
UTC ·
(2 months ago)
Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures
Web App Attack
🇵🇱
itsvic.dev
2026-09-13 05:58:00
UTC ·
(2 months ago)
34.84.159.234 - - [13/Sep/2026:05:58:00 +0000] "109.122.28.251" "GET /app/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.15) Gecko/20100101 Firefox/78.15; compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.84.15 ...
show more
34.84.159.234 - - [13/Sep/2026:05:58:00 +0000] "109.122.28.251" "GET /app/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.15) Gecko/20100101 Firefox/78.15; compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.84.159.234 - - [13/Sep/2026:05:58:00 +0000] "109.122.28.251" "GET /.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
34.84.159.234 - - [13/Sep/2026:05:58:00 +0000] "109.122.28.251" "GET /.env.local HTTP/1.1" 404 14 "-" "Mozilla/5.0 (compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot)"
...
show less
Brute-Force
Web App Attack
🇫🇮
mikkopal88
2026-09-13 03:25:47
UTC ·
(2 months ago)
Web application scan attempt
Port Scan
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-09-12 12:31:10
UTC ·
(2 months ago)
Honeypot hit: Empty payload (likely service probe); 8000 [677], 9443 [649], 5173 [38], 8888 [1], 8081 [1], 2376 [1] TCP
Port Scan
2026-09-12 10:39:15
UTC ·
(2 months ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇦🇺
2000cn.com.au
2026-09-12 10:09:14
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
IndigoRidge
2026-09-12 07:58:06
UTC ·
(2 months ago)
[12/Sep/2026:03:58:01.424781 --0400] aqUGCR7W74qkZp5ZaX-KlgAAAFU 34.84.159.234 50404 127.0.0.1 7080
[12/Sep/2026:03:58:01.597977 --0400] aqUGCd9NI3WeIbzysgM35gAAAAo 34.84.159.234 50410 127.0.0.1 7080
[12/Sep/2026:03:58:01.636644 --0400] aqUGCR7W74qkZ ...
show more
[12/Sep/2026:03:58:01.424781 --0400] aqUGCR7W74qkZp5ZaX-KlgAAAFU 34.84.159.234 50404 127.0.0.1 7080
[12/Sep/2026:03:58:01.597977 --0400] aqUGCd9NI3WeIbzysgM35gAAAAo 34.84.159.234 50410 127.0.0.1 7080
[12/Sep/2026:03:58:01.636644 --0400] aqUGCR7W74qkZp5ZaX-KmAAAAEU 34.84.159.234 50464 127.0.0.1 7080
[12/Sep/2026:03:58:01.649957 --0400] aqUGCd9NI3WeIbzysgM36QAAABQ 34.84.159.234 50488 127.0.0.1 7080
[12/Sep/2026:03:58:01.650965 --0400] aqUGCd9NI3WeIbzysgM37AAAAAI 34.84.159.234 50514 127.0.0.1 7080
...
show less
Web App Attack
🇺🇸
RAP
2026-09-12 06:49:04
UTC ·
(2 months ago)
2026-09-12 06:49:04 UTC Unauthorized activity to TCP port 8443. Web App
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 05:34:13
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.159.234 (234.159.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 01:34:06.096451 2026] [security2:error] [pid 19488:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.159.234 (234.159.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 01:34:06.096451 2026] [security2:error] [pid 19488:tid 19488] [client 34.84.159.234:46476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.97"] [uri "/static../.env"] [unique_id "aqTkTkO3-tiOL_KlwbWf_AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-12 05:33:35
UTC ·
(2 months ago)
Web Servers Malicious URL Directory Traversal.
Web App Attack
🇵🇱
lns.bz
2026-09-12 01:40:54
UTC ·
(2 months ago)
Too many 404 requests [BY]
Web App Attack
🇹🇷
rescotelecom
2026-09-12 00:56:47
UTC ·
(2 months ago)
Hosting panel login brute-force against Resco Telecom PBX. 2026-09-12 00:56:47 UTC PLESK x108 port 8443
Brute-Force
🇺🇸
TPI-Abuse
2026-09-12 00:52:04
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.84.159.234 (234.159.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 20:51:56.798465 2026] [security2:error] [pid 22259:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.159.234 (234.159.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 20:51:56.798465 2026] [security2:error] [pid 22259:tid 22259] [client 34.84.159.234:27178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.214"] [uri "/static../.env"] [unique_id "aqSiLCmbpJmtfuu5EKODhwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-11 23:40:02
UTC ·
(2 months ago)
| Common web attack.
Web App Attack
Hacking
SQL Injection
🇺🇸
LotPhantom
2026-09-11 16:50:26
UTC ·
(2 months ago)
34.84.159.234 - - [11/Sep/2026:16:49:33 +0000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.9) Gecko/20100101 Firefox/150.9; compatible; OAI-SearchBot/1.4; robots.txt; +htt ...
show more
34.84.159.234 - - [11/Sep/2026:16:49:33 +0000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.9) Gecko/20100101 Firefox/150.9; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" "0"
...
show less
Web App Attack
Bad Web Bot