2026-09-29 13:20:53
(3 weeks ago)
Scanner hitting /.git/config on mautic.osef.cloud (GOOGLE-CLOUD) — aaguard
Brute-Force
Port Scan
🇳🇱
homeshowdomain.nl
2026-09-28 22:01:54
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-27.
show less
Web App Attack
SSH
Hacking
🇵🇱
strefapi_com
2026-09-28 21:16:31
(3 weeks ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-09-28 03:10:01
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: mail.teddypot.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-09-27 15:58:50
(3 weeks ago)
(modsecurity) srv201 ModSecurity 35.204.78.8 (NL/The Netherlands/8.78.204.35.bc.googleusercontent.co ...
show more
(modsecurity) srv201 ModSecurity 35.204.78.8 (NL/The Netherlands/8.78.204.35.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-27 05:12:02
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.204.78.8 (8.78.204.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 35.204.78.8 (8.78.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 01:11:58.821933 2026] [security2:error] [pid 14017:tid 14017] [client 35.204.78.8:50822] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.quickwink.com|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.quickwink.com"] [uri "/.env.bak"] [unique_id "arilnv3qLqaK7AdWcJUOpwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-26 09:08:06
(3 weeks ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-26 08:56:38
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-25 00:07:21
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.204.78.8 (8.78.204.35.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 35.204.78.8 (8.78.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 20:07:13.643729 2026] [security2:error] [pid 25797:tid 25797] [client 35.204.78.8:57544] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.heritagecityblinds.com.au|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.heritagecityblinds.com.au"] [uri "/.env.bak"] [unique_id "arW7MSkt9UUFgeIJF0wvAgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-24 03:04:27
(4 weeks ago)
18.081 requests in 1 hour (1mo2w3d)
Brute-Force
Bad Web Bot
🇫🇷
COMAITE
2026-09-24 02:35:53
(4 weeks ago)
Suspicious URL access.
Web App Attack
🇺🇸
dot.mg
2026-09-24 02:14:02
(4 weeks ago)
Bad behaviour
Web Spam
2026-09-24 01:55:02
(4 weeks ago)
Bot / scanning and/or hacking attempts: POST / HTTP/1.1, GET /.env HTTP/1.1, GET / HTTP/1.1, GET /.e ...
show more
Bot / scanning and/or hacking attempts: POST / HTTP/1.1, GET /.env HTTP/1.1, GET / HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.development HTTP/1.1, GET /.git/config HTTP/1.1, GET /.env.staging HTTP/1.1
show less
Hacking
Web App Attack
🇬🇧
consul.to
2026-09-24 01:37:58
(4 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇮🇹
VHosting
2026-09-22 11:15:04
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack