🇳🇱
homeshowdomain.nl
2026-10-22 22:02:52
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-21.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-22 00:26:43
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 35.204.72.154 (154.72.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.72.154 (154.72.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 20:26:37.277042 2026] [security2:error] [pid 29909:tid 29909] [client 35.204.72.154:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.top-brand.us"] [uri "/.env.supabase"] [unique_id "atlYPVo6nbhNl2yNEJJstQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-21 22:01:35
(4 days ago)
Auto-ban: >3000 req/min op 2026-10-21
Web App Attack
SSH
Hacking
🇸🇪
vaia.cloud
2026-10-21 21:00:03
(4 days ago)
crowdsecurity/grafana-cve-2021-43798
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-21 17:48:42
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
2026-10-21 17:41:59
(4 days ago)
Web application attack: grafana cve 2021 43798; Web application attack: http cve 2021 41773; Web app ...
show more
Web application attack: grafana cve 2021 43798; Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Probing for exposed secret / credential files; Web application attack: http sensitive files
show less
Hacking
Web App Attack
🇦🇹
penguin-solutions.at
2026-10-21 17:40:58
(4 days ago)
Excessive 403/404 errors
...
Brute-Force
Web App Attack
2026-10-21 17:27:45
(4 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
dynamix
2026-10-21 17:19:58
(4 days ago)
Multiple WAF Violations
Web App Attack
🇹🇷
Jova
2026-10-21 16:51:02
(4 days ago)
Exploit attempts against a web server: 2 requests.
Hacking
Web App Attack
2026-10-21 16:51:02
(4 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇫🇮
oh.mg
2026-10-21 16:50:05
(4 days ago)
[Wed Oct 21 18:50:04.629281 2026] [security2:error] [pid 2219072:tid 2219075] [client 35.204.72.154: ...
show more
[Wed Oct 21 18:50:04.629281 2026] [security2:error] [pid 2219072:tid 2219075] [client 35.204.72.154:0] [client 35.204.72.154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "eu.mmn.ca"] [uri "/_next/server"] [unique_id "atjtPEAluN210qkkXWXlLAAAAUE"]
[Wed Oct 21 18:50:05.009594 2026] [security2:error] [pid 2219072:tid 2219082] [client 35.204.72.154:0] [client 35.204.72.154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "an
...
show less
Web App Attack
Bad Web Bot
🇳🇱
Site.eu
2026-10-21 16:27:05
(4 days ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
grassyloki
2026-10-21 16:25:00
(4 days ago)
Sent ~55 rapid requests in ~9s enumerating sensitive files (.env variants, ~/.ssh/id_ed25519, ~/.aws ...
show more
Sent ~55 rapid requests in ~9s enumerating sensitive files (.env variants, ~/.ssh/id_ed25519, ~/.aws/credentials, Kubernetes serviceaccount token, terraform.tfstate.backup, /proc/self/environ) using many spoofed crawler user-agents; all returned 502 with no content served.
Target: Paths /.a host, /.env?.svg?.wasm?init, /.env.production?raw, /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw, /.ssh/id_ed25519, /@fs/proc/self/cwd/.env, /server.key, /terraform.tfstate....
Seen: 2026-10-21 12:25-12:26 EDT
- 2026-10-21 12:25:55 GET /.env?.svg?.wasm?init HTTP/1.1 → 502
- 2026-10-21 12:25:55 GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/1.1 → 502
- 2026-10-21 12:25:54 GET /.ssh/id_ed25519 HTTP/1.1 → 502
- 2026-10-21 12:25:54 GET /@fs/proc/self/cwd/.env?raw?? HTTP/1.1 → 502
- 2026-10-21 12:25:56 GET /.a host?.svg?.wasm?init HTTP/1.1 → 502
- 2026-10-21 12:25:54 GET /server.key HTTP/1.1 → 502
- 2026-10-21 12:25:55 GET /terraform.tfstate.backup HTTP/1.1 → 502
show less
Web App Attack
🇫🇷
masterguru
2026-10-21 16:07:18
(4 days ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-201)
show less
Bad Web Bot
