🇳🇱
homeshowdomain.nl
2026-11-13 23:01:49
UTC ·
(8 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
🇺🇸
kosada.com
2026-11-13 16:55:12
UTC ·
(14 hours ago)
Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 03:58:17
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:58:13.209952 2026] [security2:error] [pid 23474:tid 23 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 22:58:13.209952 2026] [security2:error] [pid 23474:tid 23474] [client 34.97.92.246:55634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sinsky.net"] [uri "/.git/config"] [unique_id "avaK1TYGLN66DXu8iuTfxAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-13 03:42:37
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.97.92.246 (JP/Japan/246.92.97.34.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-11-13 02:14:02
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:13:55.372858 2026] [security2:error] [pid 174918:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:13:55.372858 2026] [security2:error] [pid 174918:tid 174918] [client 34.97.92.246:49320] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.silveranniversarynapkins.com"] [uri "/.git/config"] [unique_id "avZyYxIQnjDswFgslTdNagAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-13 01:18:19
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇳🇱
Alt255
2026-11-13 01:03:13
UTC ·
(1 day ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.97.92.246 - - [13/Nov/2026:02:03:09 +0100] "GET /.git/config HTTP/1.1" 301 654 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.97.92.246 - - [13/Nov/2026:02:03:09 +0100] "GET /.git/config HTTP/1.1" 301 654 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-11-13 00:25:07
UTC ·
(1 day ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:09:39
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:09:32.869300 2026] [security2:error] [pid 13793:tid 13 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.92.246 (246.92.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:09:32.869300 2026] [security2:error] [pid 13793:tid 13793] [client 34.97.92.246:56298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.shukrisharawico.com"] [uri "/.git/config"] [unique_id "avZVPInIANiCGVKqdggDdgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Grossmann-Gruppe
2026-11-13 00:03:53
UTC ·
(1 day ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇩🇪
SwinT
2026-11-12 23:00:07
UTC ·
(1 day ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇫🇷
Octopuce
2026-11-12 22:57:50
UTC ·
(1 day ago)
Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...
Web App Attack
🇦🇺
AWW-Admin
2026-11-12 21:29:20
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.97.92.246 (JP/Japan/246.92.97.34.bc.googleusercontent.com)
SQL Injection
🇺🇸
MatCat
2026-11-12 21:05:10
UTC ·
(1 day ago)
Banned by fail2ban: apache-webprobe
Port Scan
Bad Web Bot
🇩🇪
4server
2026-11-12 20:50:15
UTC ·
(1 day ago)
[ThuNov1221:50:11.0624802026][security2:error][pid1862675:tid1862796][client34.97.92.246:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacce ...
show more
[ThuNov1221:50:11.0624802026][security2:error][pid1862675:tid1862796][client34.97.92.246:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"webmail.shaping.ch\"][uri\"/.env.bak\"][unique_id\"avYmgxUBgMT_yr7c166YwwAAAQ4\"]
show less
Port Scan
Brute-Force
Web App Attack
