🇳🇱
Site.eu
2026-09-07 17:17:11
(1 month ago)
Excessive 404/403 errors
Brute-Force
🇳🇿
Antinson
2026-09-07 15:08:27
(1 month ago)
Scraping with a high error ratio and request rate
Bad Web Bot
2026-09-07 14:15:04
(1 month ago)
Bot / scanning and/or hacking attempts: GET /info.php HTTP/1.1, GET /production/.env HTTP/1.1, GET /development/.env HTTP/1.1, GET /.git/.env HTTP/1.1, GET /jenkins/.env HTTP/1.1, GET /config/app/.env HTTP/1.1, GET /stage/.env HTTP/1.1, GET /gitlab/. ...
show more
Bot / scanning and/or hacking attempts: GET /info.php HTTP/1.1, GET /production/.env HTTP/1.1, GET /development/.env HTTP/1.1, GET /.git/.env HTTP/1.1, GET /jenkins/.env HTTP/1.1, GET /config/app/.env HTTP/1.1, GET /stage/.env HTTP/1.1, GET /gitlab/.env HTTP/1.1, GET /uat/.env HTTP/1.1, GET /k8s/.env HTTP/1.1, GET /phpinfo.php HTTP/1.1, GET /cd/.env HTTP/1.1, GET /administrator/.env HTTP/1.1, GET /ci/.env HTTP/1.1, GET /terraform/.env HTTP/1.1
show less
Hacking
Web App Attack
🇧🇪
cmbplf
2026-09-07 13:37:22
(1 month ago)
9.624 requests with url.path *.env
1.768 requests with url.path *phpinfo.php
140 requests with url.path *.php.bak
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-07 12:06:49
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 08:06:44.499549 2026] [security2:error] [pid 12843:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 08:06:44.499549 2026] [security2:error] [pid 12843:tid 12843] [client 34.50.37.209:42518] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ruthbalser.org"] [uri "/.git/config"] [unique_id "ap6o1CM-s8rT4iSgV9rooQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-07 10:22:52
(1 month ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇫🇷
masterguru
2026-09-07 09:39:19
(1 month ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
2026-09-07 08:28:03
(1 month ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
Sonoflet
2026-09-07 07:22:22
(1 month ago)
CrowdSec detection | scenario: appsec-vpatch
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 06:49:41
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 02:49:35.961176 2026] [security2:error] [pid 20275:tid 20 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 02:49:35.961176 2026] [security2:error] [pid 20275:tid 20275] [client 34.50.37.209:37310] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rustcp.rustyog.net|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rustcp.rustyog.net"] [uri "/.env.bak"] [unique_id "ap5ef_bktpCd7Ol9lAUYEQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
srtzero
2026-09-07 06:02:36
(1 month ago)
34.50.37.209 - - [07/Sep/2026:08:02:34 +0200] "GET /.git/config HTTP/1.1" 404 1905 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.50.37.209 - - [07/Sep/2026:08:02:35 +020 ...
show more
34.50.37.209 - - [07/Sep/2026:08:02:34 +0200] "GET /.git/config HTTP/1.1" 404 1905 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.50.37.209 - - [07/Sep/2026:08:02:35 +0200] "GET /.env.local HTTP/1.1" 404 1905 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.50.37.209 - - [07/Sep/2026:08:02:35 +0200] "GET /.env.production HTTP/1.1" 404 1905 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Port Scan
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-09-07 05:16:09
(1 month ago)
Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...
Web App Attack
🇫🇷
dynamix
2026-09-07 05:10:49
(1 month ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 03:06:12
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 23:06:04.928579 2026] [security2:error] [pid 27518:tid 27 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.37.209 (209.37.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 23:06:04.928579 2026] [security2:error] [pid 27518:tid 27518] [client 34.50.37.209:43318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "russellzone.com"] [uri "/.git/config"] [unique_id "ap4qHFNBXy92N6_s5thYHwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-07 03:00:28
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
