๐ฉ๐ช
BlueWire Hosting
2026-09-18 11:39:11
(5 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
๐ฌ๐ง
consul.to
2026-09-18 08:17:21
(8 hours ago)
Web attack/malicious scanning detected
Web App Attack
๐ต๐ฑ
Budyn
2026-09-17 11:13:08
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: ts3mb.budyn.wtf | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
๐ฉ๐ช
TheDjRider
2026-09-17 11:04:27
(1 day ago)
CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban tri ...
show more
CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban triggered. Detection time (UTC): 2026-09-17T11:04:25.673844902Z. Context: http_status=302
show less
Web App Attack
๐ฉ๐ช
McClay
2026-09-17 10:16:55
(1 day ago)
Illegal access attempt:34.88.9.88 - - [17/Sep/2026:12:16:55 +0200] "GET /.git/config HTTP/1.1" 301 6 ...
show more
Illegal access attempt:34.88.9.88 - - [17/Sep/2026:12:16:55 +0200] "GET /.git/config HTTP/1.1" 301 698 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Hacking
Web App Attack
๐บ๐ฆ
URAN Publishing Service
2026-09-17 09:01:49
(1 day ago)
[17/Sep/2026:12:01:48 +0300] -- 34.88.9.88 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/co ...
show more
[17/Sep/2026:12:01:48 +0300] -- 34.88.9.88 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
show less
Bad Web Bot
Web App Attack
๐ณ๐ด
Bots.go.to.hell
2026-09-17 08:32:15
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
๐ฒ๐พ
Rizzy
2026-09-17 02:55:25
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
๐ธ๐ฌ
Cloudkul Cloudkul
2026-09-17 02:36:24
(1 day ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-16 17:20:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.88.9.88 (88.9.88.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.88.9.88 (88.9.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 13:19:58.507385 2026] [security2:error] [pid 25558:tid 25558] [client 34.88.9.88:49904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "torresyrellenos.com.disenowebprofesional.com"] [uri "/.git/config"] [unique_id "aqrPvgjsKsT0oicAZ8keHAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐ธ
Francisco Vallejo
2026-09-16 17:03:36
(1 day ago)
[Wed Sep 16 19:03:35.928076 2026] [authz_core:error] [pid 2537235:tid 126544380946112] [client 34.88 ...
show more
[Wed Sep 16 19:03:35.928076 2026] [authz_core:error] [pid 2537235:tid 126544380946112] [client 34.88.9.88:56712] AH01630: client denied by server configuration: proxy:http://localhost:9091/
[Wed Sep 16 19:03:36.038747 2026] [authz_core:error] [pid 2537235:tid 126543284135616] [client 34.88.9.88:56712] AH01630: client denied by server configuration: proxy:http://localhost:9091/
[Wed Sep 16 19:03:36.134433 2026] [authz_core:error] [pid 2537235:tid 126544164943552] [client 34.88.9.88:56712] AH01630: client denied by server configuration: proxy:http://localhost:9091/
[Wed Sep 16 19:03:36.221485 2026] [authz_core:error] [pid 2537235:tid 126542948591296] [client 34.88.9.88:56712] AH01630: client denied by server configuration: proxy:http://localhost:9091/
[Wed Sep 16 19:03:36.400047 2026] [authz_core:error] [pid 2537235:tid 126544114587328] [client 34.88.9.88:56712] AH01630: client denied by server configuration: proxy:http://localhost:9091/.git/config
...
show less
Brute-Force
SSH
๐ฉ๐ช
ghostwarriors
2026-09-16 15:50:10
(2 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
๐ฉ๐ช
yitzhaq
2026-09-16 15:31:24
(2 days ago)
34.88.9.88 - - [16/Sep/2026:17:31:20 +0200] "GET /.env.save HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; ...
show more
34.88.9.88 - - [16/Sep/2026:17:31:20 +0200] "GET /.env.save HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.9.88 - - [16/Sep/2026:17:31:20 +0200] "GET /.env.old HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.9.88 - - [16/Sep/2026:17:31:20 +0200] "GET /.env.sample HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.9.88 - - [16/Sep/2026:17:31:21 +0200] "GET /.env.example HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.9.88 - - [16/Sep/2026:17:31:21 +0200] "GET /.env.dev HTTP/1.1" 404 508 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.9.88 - - [16/Sep/2026:17:31:21 +0200] "GET /.env.prod HTTP/1.
show less
Web App Attack
Hacking
๐บ๐ธ
TPI-Abuse
2026-09-16 15:12:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.88.9.88 (88.9.88.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.88.9.88 (88.9.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 11:12:44.443618 2026] [security2:error] [pid 6993:tid 6993] [client 34.88.9.88:41426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "torahorah.com"] [uri "/.git/config"] [unique_id "aqqx7B8vP_NBm-pdj97pHQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
WeCloudit-Anti-Abuse
2026-09-16 13:46:44
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking