🇳🇱
homeshowdomain.nl
2026-11-06 22:59:22
UTC ·
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-05.
Web App Attack
SSH
Hacking
🇲🇾
Rizzy
2026-11-05 09:34:11
UTC ·
(2 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-11-05 09:30:43
UTC ·
(2 days ago)
csagent: score 21.0: 404 noise floor x4, secrets grab x2; 1 domain(s) in 4s
Web App Attack
🇩🇪
kkw
2026-11-05 09:11:52
UTC ·
(2 days ago)
[REDACTED] 34.95.15.18 - - [05/Nov/2026:10:11:51 +0100] "GET /v2/.env HTTP/2.0" 404 3255 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
... (mode: searching http-sensitive-file ...
show more
[REDACTED] 34.95.15.18 - - [05/Nov/2026:10:11:51 +0100] "GET /v2/.env HTTP/2.0" 404 3255 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
... (mode: searching http-sensitive-files)
show less
Bad Web Bot
Web App Attack
🇧🇪
Lunix
2026-11-05 07:40:56
UTC ·
(2 days ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:50:16
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.95.15.18 (18.15.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:50:12.770239 2026] [security2:error] [pid 250731:tid 250 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.15.18 (18.15.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:50:12.770239 2026] [security2:error] [pid 250731:tid 250842] [client 34.95.15.18:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ajbruner.com|F|2"] [data ".ajbruner.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ajbruner.com"] [uri "/z9x8c7v6b5-debug-trigger-www.ajbruner.com"] [unique_id "auwnJNAGSdPYre4YKOlDAwAAANQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-11-05 06:08:01
UTC ·
(2 days ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇫🇷
Zundapper
2026-11-05 05:25:50
UTC ·
(2 days ago)
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /robots.txt HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 ...
show more
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /robots.txt HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 106 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /settings HTTP/2.0" 404 167 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
34.95.15.18 - - [05/Nov/2026:06:25:50 +0100] "GET /integrations HTTP/2.0" 404 167 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
...
show less
Web App Attack
Port Scan
2026-11-05 05:24:22
UTC ·
(2 days ago)
2026-11-05: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 296 requests on web.fdfc.io. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitimate customer traffic. Automated rep ...
show more
2026-11-05: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 296 requests on web.fdfc.io. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitimate customer traffic. Automated report.
show less
Web App Attack
Hacking
🇨🇦
Etienne Pilon
2026-11-05 05:19:02
UTC ·
(2 days ago)
Observed 2026-11-05T05:19:02+00:00 to 2026-11-05T05:19:02+00:00 (UTC). HTTP: 159 requests to sensitive web paths. Active permanent IP ban verified by Observatory. Observed activity only; this is not proof of compromise.
Web App Attack
🇬🇧
SwinT
2026-11-05 02:00:05
UTC ·
(2 days ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇹🇷
pashait
2026-11-05 01:42:51
UTC ·
(2 days ago)
Auto-blocked by Seczar SecureOps — IPS Web Attack Signature (2 events in 5min) at 2026-11-05 01:42
Web App Attack
Bad Web Bot
🇺🇸
oralunal
2026-11-05 00:16:44
UTC ·
(3 days ago)
Banned by Fail2Ban - access.log - mavifinds
Web App Attack
Bad Web Bot
🇫🇷
Baking333
2026-11-04 21:53:37
UTC ·
(3 days ago)
[redacted] 34.95.15.18 - - [04/Nov/2026:22:53:34 +0100] "GET /.[redacted] HTTP/2.0" 307 41 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://[redacted]/)" [redacted] 34.95.15.18 - - [04/Nov/2026:22:53:34 +0100] "GET /.[redacted] HTTP/2.0" 30 ...
show more
[redacted] 34.95.15.18 - - [04/Nov/2026:22:53:34 +0100] "GET /.[redacted] HTTP/2.0" 307 41 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://[redacted]/)" [redacted] 34.95.15.18 - - [04/Nov/2026:22:53:34 +0100] "GET /.[redacted] HTTP/2.0" 307 41 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://[redacted]/)"
show less
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-11-04 21:36:00
UTC ·
(3 days ago)
31 attempts against mh_ha-misbehave-ban on sedna
Brute-Force
Bad Web Bot
Web App Attack
