2026-10-28 12:12:18
(10 hours ago)
104.28.234.184 - - [28/Oct/2026:13:12:18 +0100] "GET /.git-credentials HTTP/1.1" 403 146 "https://www.google.com/search?q=unifi.adm.vantulder.net" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
Brute-Force
Web App Attack
🇺🇸
francelink.fr
2026-10-28 06:35:23
(16 hours ago)
Azure WAF blocked a request. Rule: 100200. Observed at: 2026-10-28T06:32:03.000Z.
Web App Attack
2026-10-28 06:30:41
(16 hours ago)
[da.kdns.gr] httpd-config-scan: sites=www.rheumatologiko.gr; logs=/var/log/httpd/domains/rheumatologiko.gr.log; samples=/wp-config.php.bak — shared egress: Cloudflare WARP / iCloud Private Relay
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-27 10:51:57
(1 day ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.234.184 - - \[27/Oct/2026:11:51:38 +0100\] "GET /.git/HEAD HTTP/1.1" 301 5809 "https://www.google.com/search\?q=janpetershorst.nl" "Mozilla/5.0 Ap ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.234.184 - - \[27/Oct/2026:11:51:38 +0100\] "GET /.git/HEAD HTTP/1.1" 301 5809 "https://www.google.com/search\?q=janpetershorst.nl" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; compatible\; ChatGPT-User/1.0\; +https://openai.com/bot\)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-27 07:18:24
(1 day ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [27/Oct/2026:08:18:16 +0100] "GET /.env.backup HTTP/1.1" 404 10308 "https://www.google.com/search?q=gevelwerken.nu" "Mozilla/5 ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [27/Oct/2026:08:18:16 +0100] "GET /.env.backup HTTP/1.1" 404 10308 "https://www.google.com/search?q=gevelwerken.nu" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
creechy
2026-10-27 03:41:01
(1 day ago)
104.28.234.184 - - [26/Oct/2026:20:40:57 -0700] "GET /.env.production.local HTTP/1.1" 404 773 "https://www.google.com/search?q=fakebelieve.org" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 S ...
show more
104.28.234.184 - - [26/Oct/2026:20:40:57 -0700] "GET /.env.production.local HTTP/1.1" 404 773 "https://www.google.com/search?q=fakebelieve.org" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
...
show less
Hacking
Bad Web Bot
🇩🇪
Hary74656
2026-10-27 01:43:20
(1 day ago)
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 104.28.234.184] [realclient 104.28.234.184] [27/Oct/2026:02:43:19 +0100] [vhost tools.aschi.at] 403 "GET /.env.test HTTP/1.1"
Web App Attack
2026-10-26 23:05:20
(1 day ago)
Web attack blocked by WAF: GET /.env, GET /.env.test, GET /config.yaml (Direct access to sensitive file or dotfile; Hidden file access).
[27/Oct/2026:02:05:12 +0300] "GET /.env HTTP/1.1" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ...
show more
Web attack blocked by WAF: GET /.env, GET /.env.test, GET /config.yaml (Direct access to sensitive file or dotfile; Hidden file access).
[27/Oct/2026:02:05:12 +0300] "GET /.env HTTP/1.1" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)" -> Direct access to sensitive file or dotfile
[27/Oct/2026:02:05:16 +0300] "GET /.env.test HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like G" -> Hidden file access
[27/Oct/2026:02:05:18 +0300] "GET /config.yaml HTTP/1.1" UA="Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" -> Found crawler not in whitelist; Fake Googlebot detected (IP not in Google ranges)
show less
Web App Attack
🇳🇱
Alt255
2026-10-26 06:21:15
(2 days ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [26/Oct/2026:07:21:13 +0100] "GET /.aws/credentials HTTP/1.1" 301 6374 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebK ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [26/Oct/2026:07:21:13 +0100] "GET /.aws/credentials HTTP/1.1" 301 6374 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 00:18:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.234.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 20:18:11.346161 2026] [security2:error] [pid 23124:tid 23124] [client 104.28.234.184:11969] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.234.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 20:18:11.346161 2026] [security2:error] [pid 23124:tid 23124] [client 104.28.234.184:11969] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.encoreporchfest.info"] [uri "/.env.backup"] [unique_id "at6cQ-37apSsdgqXJmW_xAAAAAU"], referer: https://www.google.com/search?q=www.encoreporchfest.info
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-24 23:34:09
(3 days ago)
[livebd] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [25/Oct/2026:01:34:04 +0200] "GET /.env.local HTTP/1.1" 404 7902 "https://www.google.com/search?q=jansen.bdaconnect.nl" "Mozill ...
show more
[livebd] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.234.184 - - [25/Oct/2026:01:34:04 +0200] "GET /.env.local HTTP/1.1" 404 7902 "https://www.google.com/search?q=jansen.bdaconnect.nl" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
104.28.234.184 - - [25/Oct/2026:01:34:04 +0200] "GET /.env.production HTTP/1.1" 404 7902 "https://www.google.com/search?q=jansen.bdaconnect.nl" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-10-24 21:58:07
(4 days ago)
[news.tmg.gr] httpd-config-scan: sites=www.dunantcongress2022.gr; logs=/var/log/httpd/domains/dunantcongress2022.gr.log; samples=/.env.sample — shared egress: Cloudflare WARP / iCloud Private Relay
Hacking
Web App Attack
🇺🇸
jcbriar
2026-10-24 20:43:24
(4 days ago)
Searching for vulnerable scripts
Hacking
Web App Attack
🇩🇪
Grossmann-Gruppe
2026-10-24 19:43:51
(4 days ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-10-24 19:15:38
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.234.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 15:15:33.021566 2026] [security2:error] [pid 7916:tid 7916] [client 104.28.234.184:17456] M ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.234.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 15:15:33.021566 2026] [security2:error] [pid 7916:tid 7916] [client 104.28.234.184:17456] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ericdrives.com.aim-controls.com"] [uri "/.git/config"] [unique_id "at0D1QkkEBntgBOVKA7bSwAAAA0"], referer: https://www.google.com/search?q=ericdrives.com.aim-controls.com
show less
Brute-Force
Bad Web Bot
Web App Attack
