2026-10-29 04:32:31
UTC ·
(2 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇸🇪
vaia.cloud
2026-10-28 09:10:02
UTC ·
(2 weeks ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇧🇾
lns.bz
2026-10-28 09:08:17
UTC ·
(2 weeks ago)
Too many 404 requests [BY]
Web App Attack
🇩🇪
webanyone
2026-10-27 17:08:31
UTC ·
(2 weeks ago)
Secret file probe | method: GET | path: /.git/config | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 16:41:32
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.96.141.7 (7.141.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 12:41:28.506602 2026] [security2:error] [pid 23935:tid 2393 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.96.141.7 (7.141.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 12:41:28.506602 2026] [security2:error] [pid 23935:tid 23935] [client 34.96.141.7:39970] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web136.dnchosting.com"] [uri "/.git/config"] [unique_id "auDUOBxwmwsHOia_uTgSFgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
LSPCCU
2026-10-27 08:01:13
UTC ·
(2 weeks ago)
TSEC Honeypot Network report. Threat score: 80/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: galah, h0neytr4p. Context: Attacker IP 34.96.141.7 observed using TLS client fingerprint 'Unknown TLS Client (e1db13f18329 ...
show more
TSEC Honeypot Network report. Threat score: 80/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: galah, h0neytr4p. Context: Attacker IP 34.96.141.7 observed using TLS client fingerprint 'Unknown TLS Client (e1db13f18329)' 2 times when connecting to a energy sector honeypot between 2026-10-27 05:14 and 2026-10-27 05:15 UTC.
show less
Port Scan
Hacking
Brute-Force
Web App Attack
SSH
🇩🇪
weiss
2026-10-27 05:07:32
UTC ·
(2 weeks ago)
CrowdSec blocked IP (crowdsecurity/http-sensitive-files) on pixel-edge
Web App Attack
🇩🇪
Progetto1
2026-10-27 05:01:02
UTC ·
(2 weeks ago)
Detected via HAProxyScanner at 2026-10-27 05:01:01 UTC on destination port WEB (80/443). Repeated scan / connection.
Port Scan
Hacking
Brute-Force
2026-10-27 04:20:40
UTC ·
(2 weeks ago)
34.96.141.7 - - [27/Oct/2026:04:20:39 +0000] "GET /mailer/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.96.141.7 - - [27/Oct/2026:04:20:39 +00 ...
show more
34.96.141.7 - - [27/Oct/2026:04:20:39 +0000] "GET /mailer/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.96.141.7 - - [27/Oct/2026:04:20:39 +0000] "GET /mail/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
...
show less
Port Scan
Hacking
Bad Web Bot
🇵🇱
Budyn
2026-10-27 04:02:11
UTC ·
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vpn.goblinpot.online | URI: /.git/config | UA: Mo ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vpn.goblinpot.online | URI: /.git/config | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"HK","Cf-Connecting-Ip":"34.96.141.7","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a50ecdc4ca6dd84a-HKG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-Nextjs-Requ
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-27 01:50:26
UTC ·
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vpn.astropot.site | URI: /.git/config | UA: Mozil ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vpn.astropot.site | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"HK","Cf-Connecting-Ip":"34.96.141.7","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a50e0cc7d862dd9f-HKG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-Nextjs-Request-Id":"
show less
Bad Web Bot
Web App Attack
🇨🇦
Sakusen
2026-10-26 23:14:05
UTC ·
(2 weeks ago)
Automated web attack: 277 reqs, 267 paths probed, 232 returned 404; probed: 206 .env, 44 .php, 9 .json, 4 secret, 2 other, 1 .git, 1 cloud-cred
Hacking
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-10-26 22:37:39
UTC ·
(2 weeks ago)
P2S/Node.js exploit tester, but noone asked for it
2026/10/26 23:37:37 [error] 1626351#1626351: *27987 [client 34.96.141.7] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_IN ...
show more
P2S/Node.js exploit tester, but noone asked for it
2026/10/26 23:37:37 [error] 1626351#1626351: *27987 [client 34.96.141.7] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `55' ) [file "/etc/nginx/modsec/coreruleset-4.30.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 55)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.30.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "*REDACTED*"] [uri "/"] [unique_id "179305425795.790449"] [ref ""], client: 34.96.141.7, server: vpamk.*REDACTED*, request: "POST / HTTP/1.1", host: ".*REDACTED*"
show less
Web App Attack
🇳🇱
e.fierstra
2026-10-26 22:27:16
UTC ·
(2 weeks ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-10-26 21:32:15
UTC ·
(2 weeks ago)
P2S/Node.js exploit tester, but noone asked for it
2026/10/26 22:32:14 [error] 1626348#1626348: *24998 [client 34.96.141.7] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_IN ...
show more
P2S/Node.js exploit tester, but noone asked for it
2026/10/26 22:32:14 [error] 1626348#1626348: *24998 [client 34.96.141.7] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `55' ) [file "/etc/nginx/modsec/coreruleset-4.30.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 55)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.30.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "*REDACTED*"] [uri "/"] [unique_id "179305033367.517557"] [ref ""], client: 34.96.141.7, server: vpamk.*REDACTED*, request: "POST / HTTP/1.1", host: "vpamk.*REDACTED*"
show less
Web App Attack
