2026-11-14 17:29:32
UTC ·
(48 minutes ago)
jails=sensitive-probe; categories=14,21; events=1; first=2026-11-14T17:29:32Z; last=2026-11-14T17:29:32Z
Port Scan
Web App Attack
🇳🇱
e.fierstra
2026-11-14 16:30:02
UTC ·
(1 hour ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-11-14 11:34:10
UTC ·
(6 hours ago)
csagent: score 21.0: 404 noise floor x4, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇨🇭
TheCoon
2026-11-14 11:06:14
UTC ·
(7 hours ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇬🇧
thetomtaylor.co.uk
2026-11-14 09:08:02
UTC ·
(9 hours ago)
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02]
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-11-14 08:08:00
UTC ·
(10 hours ago)
Fail2Ban - [RECIDIVE]Repeat offender across multiple jails on recidive ... [ice01,ice02,mx01,mx02,mx03,wa01,wa02]
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
2026-11-14 02:24:10
UTC ·
(15 hours ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇫🇷
masterguru
2026-11-14 01:59:27
UTC ·
(16 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 00:46:54
UTC ·
(17 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 19:46:48.420649 2026] [security2:error] [pid 8370:tid 8370] ...
show more
(mod_security) mod_security (id:949110) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 19:46:48.420649 2026] [security2:error] [pid 8370:tid 8370] [client 34.88.70.37:53656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "taxijunkremoval.com"] [uri "/.git/config"] [unique_id "aveveBkPduisRJFZ099vKwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-13 23:49:54
UTC ·
(18 hours ago)
Secret file probe | method: GET | path: /.git/config | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking
Web App Attack
2026-11-13 23:43:03
UTC ·
(18 hours ago)
Bot / scanning and/or hacking attempts: GET /cloud/.env HTTP/1.1, GET /rabbitmq/.env HTTP/1.1, GET /cd/.env HTTP/1.1, GET /worker/.env HTTP/1.1, GET /redis/.env HTTP/1.1, GET /kafka/.env HTTP/1.1, GET /mongodb/.env HTTP/1.1, GET /elasticsearch/.env H ...
show more
Bot / scanning and/or hacking attempts: GET /cloud/.env HTTP/1.1, GET /rabbitmq/.env HTTP/1.1, GET /cd/.env HTTP/1.1, GET /worker/.env HTTP/1.1, GET /redis/.env HTTP/1.1, GET /kafka/.env HTTP/1.1, GET /mongodb/.env HTTP/1.1, GET /elasticsearch/.env HTTP/1.1, GET /queue/.env HTTP/1.1, GET /test.php HTTP/1.1, GET /dev/phpinfo.php HTTP/1.1, GET /debug.php HTTP/1.1, GET /php-info.php HTTP/1.1, GET /old/phpinfo.php HTTP/1.1, GET /test/phpinfo.php HTTP/1.1, GET /admin/phpinfo.php HTTP/1.1, GET /public/phpinfo.php HTTP/1.1, GET /p.php HTTP/1.1, GET /phpinfo HTTP/1.1, GET /tmp/phpinfo.php HTTP/1.1, GET /info HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-13 23:00:40
UTC ·
(19 hours ago)
Auto-ban: >3000 req/min op 2026-11-13
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-11-13 16:45:47
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:45:40.414892 2026] [security2:error] [pid 4975:tid 4975] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:45:40.414892 2026] [security2:error] [pid 4975:tid 4975] [client 34.88.70.37:54422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tavo.info"] [uri "/.git/config"] [unique_id "avc-tPMlEnBnc3sQxb5zTgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
leo1305
2026-11-13 14:23:29
UTC ·
(1 day ago)
CrowdSec detection | scenario: http-probing
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 13:51:49
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:51:42.834023 2026] [security2:error] [pid 16596:tid 1659 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.88.70.37 (37.70.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:51:42.834023 2026] [security2:error] [pid 16596:tid 16596] [client 34.88.70.37:56158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tausiet.com"] [uri "/.git/config"] [unique_id "avcV7sNlzi9056qH1ajLuAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
