🇺🇸
TPI-Abuse
2026-11-14 03:46:36
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 43.131.9.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:46:31.942592 2026] [security2:error] [pid 14055:tid 14055] [client 43.131.9.169:53662] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 43.131.9.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 22:46:31.942592 2026] [security2:error] [pid 14055:tid 14055] [client 43.131.9.169:53662] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebeesgold.com"] [uri "/.git/config"] [unique_id "avfZlxGhQgOLLTYScC7IHAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-10 11:37:23
UTC ·
(3 days ago)
{"level":"info","ts":1794310643.181121,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"43.131.9.169","remote_port":"45322","client_ip":"43.131.9.169","proto":"HTTP/1.1","method":"GET","host":"updown.ifae.fr","uri":"/cl ...
show more
{"level":"info","ts":1794310643.181121,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"43.131.9.169","remote_port":"45322","client_ip":"43.131.9.169","proto":"HTTP/1.1","method":"GET","host":"updown.ifae.fr","uri":"/client/.env","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["1d71b928"],"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"updown.ifae.fr","ech":false}},"bytes_read":0,"user_id":"","duration":0.000105391,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1794310643.2090187,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"43.131.9.169","remote_port":"45
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 11:04:44
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 43.131.9.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:04:40.899295 2026] [security2:error] [pid 19728:tid 19728] [client 43.131.9.169:52288] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 43.131.9.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:04:40.899295 2026] [security2:error] [pid 19728:tid 19728] [client 43.131.9.169:52288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stgeorgellc.com"] [uri "/.git/config"] [unique_id "avL6SJjMdyMCveGVJXagywAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-10 10:44:24
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cloud.astropot.space | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x86_64) Apple ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cloud.astropot.space | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-11-10 08:07:27
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cdn.astropot.site | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 1 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cdn.astropot.site | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-09 22:59:42
UTC ·
(4 days ago)
Auto-ban: >3000 req/min op 2026-11-09
Web App Attack
SSH
Hacking
🇩🇪
pscriptos
2026-11-09 09:48:03
UTC ·
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/appsec-vpatch
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-06 23:00:46
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-05.
Web App Attack
SSH
Hacking
🇳🇱
Alt255
2026-11-06 22:11:00
UTC ·
(1 week ago)
[mx01aln] Web exploit scanning: 17 suspicious requests detected by fail2ban jail apache-scanner. Example: 43.131.9.169 - - [06/Nov/2026:23:10:40 +0100] "GET /.git/config HTTP/1.1" 301 624 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebK ...
show more
[mx01aln] Web exploit scanning: 17 suspicious requests detected by fail2ban jail apache-scanner. Example: 43.131.9.169 - - [06/Nov/2026:23:10:40 +0100] "GET /.git/config HTTP/1.1" 301 624 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.131.9.169 - - [06/Nov/2026:23:10:40 +0100] "GET /.env HTTP/1.1" 301 610 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.131.9.169 - - [06/Nov/2026:23:10:40 +0100] "GET /.env.local HTTP/1.1" 301 622 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.131.9.169 - - [06/Nov/2026:23:10:40 +0100] "GET /.env.production HTTP/1.1" 301 632 "-" "Mozilla/5.0 (Macint
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-06 21:01:26
UTC ·
(1 week ago)
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 43.131.9.169 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇩🇪
schuerholz
2026-11-06 20:43:04
UTC ·
(1 week ago)
Web application attack detected by WAF (OWASP CRS, 27 high-volume alert(s) in 24h, e.g. /.env.staging, /.env.backup, /.env.example). Automated detection.
Web App Attack
Hacking
🇫🇷
masterguru
2026-11-06 20:30:26
UTC ·
(1 week ago)
Remote Command Execution: Unix Shell Expression Found. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})| (932130-131)
Hacking
🇩🇪
netclix.gr
2026-11-06 17:48:21
UTC ·
(1 week ago)
(security_scan) Sensitive File Scan Blocked 43.131.9.169 (DE/Germany/-)
Hacking
2026-11-05 21:30:29
UTC ·
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-11-05 17:50:04
UTC ·
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
