🇨🇭
TheCoon
2026-11-08 11:17:34
UTC ·
(3 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-24 16:38:39
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:42:55
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-21 07:04:05
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇩🇪
xavier-momain.eu
2026-09-25 17:48:19
UTC ·
(1 month ago)
CrowdSec ban — scenario: ssh:bruteforce | report #2
Brute-Force
SSH
🇹🇷
neron
2026-09-23 21:38:37
UTC ·
(1 month ago)
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
xavier-momain.eu
2026-09-23 06:11:48
UTC ·
(1 month ago)
CrowdSec ban — scenario: ssh:bruteforce
Brute-Force
SSH
🇹🇷
neron
2026-09-19 21:28:48
UTC ·
(1 month ago)
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇳🇱
Alt255
2026-09-17 12:09:43
UTC ·
(1 month ago)
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 89.187.178.151 - - [17/Sep/2026:14:09:28 +0200] "GET /.env HTTP/1.1" 404 7808 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show more
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 89.187.178.151 - - [17/Sep/2026:14:09:28 +0200] "GET /.env HTTP/1.1" 404 7808 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-06-25 19:12:45
UTC ·
(4 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
4server
2026-06-25 18:55:36
UTC ·
(4 months ago)
[ThuJun2520:55:31.1364052026][security2:error][pid1542824:tid1542906][client89.187.178.151:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\ ...
show more
[ThuJun2520:55:31.1364052026][security2:error][pid1542824:tid1542906][client89.187.178.151:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"ksmstudio.ch\"][uri\"/src/.env\"][unique_id\"aj15ozUIOwXEraiQbgx1UAAAAAc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 17:54:24
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 89.187.178.151 (unn-89-187-178-151.cdn77.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 13:54:18.888119 2026] [security2:error] [pid 31213:tid 31225] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 89.187.178.151 (unn-89-187-178-151.cdn77.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 13:54:18.888119 2026] [security2:error] [pid 31213:tid 31225] [client 89.187.178.151:63819] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "indigocapital.es"] [uri "/.env.production"] [unique_id "aj1rShb4w6JyVnmzG5gk9wAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-25 17:23:19
UTC ·
(4 months ago)
Multiple WAF Violations
Web App Attack
🇮🇹
Progetto1
2026-06-25 16:45:04
UTC ·
(4 months ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 20:58:59
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 89.187.178.151 (unn-89-187-178-151.cdn77.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 16:58:54.400582 2026] [security2:error] [pid 19407:tid 19407] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 89.187.178.151 (unn-89-187-178-151.cdn77.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 16:58:54.400582 2026] [security2:error] [pid 19407:tid 19407] [client 89.187.178.151:56885] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wallet.joebankx.com"] [uri "/.git/config"] [unique_id "ajxFDsZ_ufzyUCBpdwbxZAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack