🇳🇱
homeshowdomain.nl
2026-11-13 23:00:38
UTC ·
(15 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
🇳🇦
jacqueskruger
2026-11-13 19:27:33
UTC ·
(18 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-13T19:15:21Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-13T19:15:21Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇨🇦
Anytech
2026-11-13 19:06:33
UTC ·
(19 hours ago)
Blocked by ConnMonitor
Web App Attack
🇧🇪
cmbplf
2026-11-13 18:39:38
UTC ·
(19 hours ago)
1.788 requests with url.path *.env
Brute-Force
Bad Web Bot
🇧🇷
radardatelecom
2026-11-13 16:55:04
UTC ·
(21 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 16:08:21
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.96.180.8 (8.180.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:08:16.565199 2026] [security2:error] [pid 10070:tid 1007 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.96.180.8 (8.180.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:08:16.565199 2026] [security2:error] [pid 10070:tid 10070] [client 34.96.180.8:40466] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vicmackenzie.com"] [uri "/.git/config"] [unique_id "avc18GsWZEqzIZ1AZHefeAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
onlyops.app
2026-11-13 14:00:08
UTC ·
(1 day ago)
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-modsecurity jail) | onlyops.app
Exploited Host
🇺🇸
TPI-Abuse
2026-11-13 12:09:17
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.96.180.8 (8.180.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:09:14.220738 2026] [security2:error] [pid 22447:tid 2244 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.96.180.8 (8.180.96.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 07:09:14.220738 2026] [security2:error] [pid 22447:tid 22447] [client 34.96.180.8:33260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vibratingharvard.com"] [uri "/.git/config"] [unique_id "avb96u3wz1Rd2YfKZPI8jQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-11-13 11:16:40
UTC ·
(1 day ago)
(secretscan) Secret-Scanner (env/git/ssh/credentials) from 34.96.180.8 (HK/Hong Kong/8.180.96.34.bc.googleusercontent.com)
Hacking
🇸🇪
vaia.cloud
2026-11-13 10:40:01
UTC ·
(1 day ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇧🇾
lns.bz
2026-11-13 10:33:56
UTC ·
(1 day ago)
.env scanning [BY]
Web App Attack
🇩🇪
Packets-Decreaser.NET
2026-11-13 09:26:05
UTC ·
(1 day ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web App Attack
2026-11-13 09:04:44
UTC ·
(1 day ago)
[abuseipdb-autoban] 2026-11-13 09:04:44, Client: 34.96.180.8, Protocol: 6 (TCP), Service: HTTP, Activity: auto-banned after exceeding AbuseIPDB score threshold on visit to /, likely unclassified automated client, AbuseIPDB score at ban time: 100% (19 ...
show more
[abuseipdb-autoban] 2026-11-13 09:04:44, Client: 34.96.180.8, Protocol: 6 (TCP), Service: HTTP, Activity: auto-banned after exceeding AbuseIPDB score threshold on visit to /, likely unclassified automated client, AbuseIPDB score at ban time: 100% (19 prior reports)
show less
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-11-13 08:54:45
UTC ·
(1 day ago)
Too many 404 requests [BY]
Web App Attack
2026-11-13 03:53:02
UTC ·
(1 day ago)
Bot / scanning and/or hacking attempts: GET /deploy/.env HTTP/1.1, GET /private/.env HTTP/1.1, GET /application/.env HTTP/1.1, GET /dist/.env HTTP/1.1, GET /htdocs/.env HTTP/1.1, GET /storage/.env HTTP/1.1, GET /var/www/.env HTTP/1.1, GET /build/.env ...
show more
Bot / scanning and/or hacking attempts: GET /deploy/.env HTTP/1.1, GET /private/.env HTTP/1.1, GET /application/.env HTTP/1.1, GET /dist/.env HTTP/1.1, GET /htdocs/.env HTTP/1.1, GET /storage/.env HTTP/1.1, GET /var/www/.env HTTP/1.1, GET /build/.env HTTP/1.1, GET /releases/.env HTTP/1.1, GET /public_html/.env HTTP/1.1, GET /www/.env HTTP/1.1, GET /live/.env HTTP/1.1, GET /html/.env HTTP/1.1, GET /prod/.env HTTP/1.1, GET /dev/.env HTTP/1.1, GET /.env.uat HTTP/1.1, GET /release/.env HTTP/1.1, GET /opt/.env HTTP/1.1, GET /staging/.env HTTP/1.1, GET /current/.env HTTP/1.1, GET /.env_copy HTTP/1.1, GET /site/.env HTTP/1.1
show less
Hacking
Web App Attack
