🇩🇪
defkev
2026-09-10 02:21:57
UTC ·
(2 months ago)
Attempted Administrator Privilege Gain, Web Application Attack, Attempted Information Leak
Hacking
🇺🇸
TPI-Abuse
2026-09-10 02:21:51
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 22:21:45.524495 2026] [security2:error] [pid 18095:tid 18 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 22:21:45.524495 2026] [security2:error] [pid 18095:tid 18095] [client 34.90.14.110:28062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.10"] [uri "/.env"] [unique_id "aqIUOcywaZ0Xft0t-nIN6wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-10 01:20:16
UTC ·
(2 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-09 20:05:54
UTC ·
(2 months ago)
20 attempts against mh_ha-misbehave-ban on solar
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dbmwebdesign
2026-09-09 15:50:18
UTC ·
(2 months ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
Anonymous
2026-09-09 15:38:08
UTC ·
(2 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇩🇪
maxpower
2026-09-09 15:31:12
UTC ·
(2 months ago)
(junkbot) REGOLA 8 - Junk Bot Blocked 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.90.14.110 - - [09/Sep/2026:17:31:10 +0200] "GET /__aws_leak_probe_5f9 ...
show more
(junkbot) REGOLA 8 - Junk Bot Blocked 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.90.14.110 - - [09/Sep/2026:17:31:10 +0200] "GET /__aws_leak_probe_5f99ec48__ HTTP/1.1" 200 12040 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" "-" host=145.239.233.178
show less
Port Scan
🇫🇷
Thibault Millant
2026-09-09 15:20:49
UTC ·
(2 months ago)
34.90.14.110 - - [09/Sep/2026:15:20:28 +0000] "GET /@fs/root/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1" 404 118 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Slackbot-LinkExpanding/1.0; +https://api.slac ...
show more
34.90.14.110 - - [09/Sep/2026:15:20:28 +0000] "GET /@fs/root/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1" 404 118 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Slackbot-LinkExpanding/1.0; +https://api.slack.com/robots)"
...
show less
Brute-Force
Exploited Host
SSH
🇳🇱
Savvii
2026-09-09 13:56:05
UTC ·
(2 months ago)
20 attempts against mh-misbehave-ban on star
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-09 12:35:56
UTC ·
(2 months ago)
20 attempts against mh-misbehave-ban on storm
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-09 07:48:49
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 03:48:41.632725 2026] [security2:error] [pid 32190:tid 32 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 03:48:41.632725 2026] [security2:error] [pid 32190:tid 32190] [client 34.90.14.110:33146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.31"] [uri "/static../.env"] [unique_id "aqEPWbvFWx4d_q51cnyKnAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇼
kk_it_man
2026-09-09 06:43:02
UTC ·
(2 months ago)
ET INFO ChatGPT-User Traffic Detected Inbound M1
ET INFO ChatGPT-User Traffic Detected Inbound M2
ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak
ET INFO Request to Hidden Environment File - Inbound
ET SCAN SFTP/F ...
show more
ET INFO ChatGPT-User Traffic Detected Inbound M1
ET INFO ChatGPT-User Traffic Detected Inbound M2
ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak
ET INFO Request to Hidden Environment File - Inbound
ET SCAN SFTP/FTP Password Exposure via sftp-config.json
ET WEB_SERVER .bash_history Detected in URI
ET WEB_SERVER /etc/passwd Detected in URI
ET WEB_SERVER Likely Malicious Request for /proc/self/environ
ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability
ET WEB_SERVER WEB-PHP phpinfo access
ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208)
ET WEB_SPECIFIC_APPS Wordpress LiteSpeed Cache Plugin debug.log Access Attempt (CVE-2024-44000)
show less
Port Scan
🇳🇱
Roderic
2026-09-09 05:57:19
UTC ·
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-09-09 05:15:52
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 01:15:47.215572 2026] [security2:error] [pid 23502:tid 23 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.90.14.110 (110.14.90.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 01:15:47.215572 2026] [security2:error] [pid 23502:tid 23502] [client 34.90.14.110:29870] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.215"] [uri "/static../.env"] [unique_id "aqDrg4fqGb0KXDhXupY--wAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-09 04:09:15
UTC ·
(2 months ago)
denied traffic to a honeypot network. destination port 8443.
Port Scan
Hacking