🇪🇸
librebit
2026-10-28 18:12:25
(7 hours ago)
Brute force
Brute-Force
🇳🇱
Site.eu
2026-10-28 10:18:29
(15 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-28 09:58:50
(15 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: test.sweetpuddingtrap.online | URI: /.git/config ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: test.sweetpuddingtrap.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"HK","Cf-Connecting-Ip":"34.92.147.221","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a51915961fe4da02-HKG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-Nextjs-
show less
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-27 18:07:58
(1 day ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-27 UTC.
Brute-Force
🇩🇪
marten_o
2026-10-27 12:24:19
(1 day ago)
34.92.147.221 - - [27/Oct/2026:13:24:19 +0100] "GET /tmp/phpinfo.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 323 458
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 12:13:25
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 08:13:17.921105 2026] [security2:error] [pid 22033:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 08:13:17.921105 2026] [security2:error] [pid 22033:tid 22033] [client 34.92.147.221:40530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "therealseska.com"] [uri "/.git/config"] [unique_id "auCVXdlJA7nO1Utt3nOiXQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-27 10:40:19
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇰🇷
Jaewon
2026-10-27 09:33:31
(1 day ago)
Automated probing for exposed secrets and admin paths (.env, .git, wp-*, *.php). Banned and reported automatically by fail2ban.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 06:45:58
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 02:45:53.987257 2026] [security2:error] [pid 17779:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 02:45:53.987257 2026] [security2:error] [pid 17779:tid 17779] [client 34.92.147.221:42862] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thepotteriesmesilla.com"] [uri "/.git/config"] [unique_id "auBIoWsfZsZKUzY6dNEzBgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-27 05:11:44
(1 day ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x1; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 04:37:32
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:37:26.946705 2026] [security2:error] [pid 7233:tid 7 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:37:26.946705 2026] [security2:error] [pid 7233:tid 7233] [client 34.92.147.221:40452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thepinelandclub.com"] [uri "/.git/config"] [unique_id "auAqhlsiP1u6x0IbFgJnGgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 04:19:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:19:30.896422 2026] [security2:error] [pid 18013:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.147.221 (221.147.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 00:19:30.896422 2026] [security2:error] [pid 18013:tid 18013] [client 34.92.147.221:60402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thepianosmith.com"] [uri "/.git/config"] [unique_id "auAmUutjD-mM8dl-BSj_HAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
poundawebsiteltd
2026-10-27 03:18:36
(1 day ago)
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 34.92.147.221 (HK/Hong Kong/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 34.92.147.221 (HK/Hong Kong/221.147.92.34. ...
show more
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 34.92.147.221 (HK/Hong Kong/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 34.92.147.221 (HK/Hong Kong/221.147.92.34.bc.googleusercontent.com): 20 in the last 3600 secs
show less
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-10-27 02:53:03
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-10-27 01:51:06
(1 day ago)
Blocked by ConnMonitor
Web App Attack
