🇺🇸
RogueAutomata
2026-09-06 03:24:52
UTC ·
(2 months ago)
Detected malicious request: GET /public/.git/config
Detections triggered: Environment/config probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 00:39:09
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:39:04.563847 2026] [security2:error] [pid 2324:tid 2324] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:39:04.563847 2026] [security2:error] [pid 2324:tid 2324] [client 34.102.70.5:47158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bwill.dev"] [uri "/site/.git/config"] [unique_id "apy2KC1fwULStzUDQPWjuwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
evicky2002
2026-09-06 00:02:40
UTC ·
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇬🇧
consul.to
2026-09-05 23:36:57
UTC ·
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
Anonymous
2026-09-05 22:36:04
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /wordpress/.git/config HTTP/1.1, GET /.git/config HTTP/1.1, GET /site/.git/config HTTP/1.1, GET /htdocs/.git/config HTTP/1.1, GET /backend/.git/config HTTP/1.1, GET /var/www/.git/config HTTP/1.1, GET /www/. ...
show more
Bot / scanning and/or hacking attempts: GET /wordpress/.git/config HTTP/1.1, GET /.git/config HTTP/1.1, GET /site/.git/config HTTP/1.1, GET /htdocs/.git/config HTTP/1.1, GET /backend/.git/config HTTP/1.1, GET /var/www/.git/config HTTP/1.1, GET /www/.git/config HTTP/1.1, GET /api/.git/config HTTP/1.1, GET /app/.git/config HTTP/1.1, GET /src/.git/config HTTP/1.1, GET /public/.git/config HTTP/1.1, GET /html/.git/config HTTP/1.1
show less
Hacking
Web App Attack
🇫🇮
YF
2026-09-05 22:30:29
UTC ·
(2 months ago)
Git config exposure probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 21:30:28
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:30:20.193049 2026] [security2:error] [pid 2497:tid 2497] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:30:20.193049 2026] [security2:error] [pid 2497:tid 2497] [client 34.102.70.5:42146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "victorvictorloft.com"] [uri "/wordpress/.git/config"] [unique_id "apyJ7OzTpwfpYfR7K1EsKwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
sid3windr
2026-09-05 09:54:53
UTC ·
(2 months ago)
GET /.git/config (Tarpitted for 4m20s, wasted 15.35kB)
Web App Attack
🇳🇱
SysAdmin Dylan
2026-09-05 02:32:20
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (US/United States/5.70.102.34.bc.googleusercontent.com): 10 in the last 3600 secs
Brute-Force
🇳🇱
homeshowdomain.nl
2026-09-04 22:00:13
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-03.
Web App Attack
SSH
Hacking
Anonymous
2026-09-04 21:46:48
UTC ·
(2 months ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-04 21:21:14
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:21:08.193455 2026] [security2:error] [pid 24258:tid 2425 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:21:08.193455 2026] [security2:error] [pid 24258:tid 24258] [client 34.102.70.5:39052] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.hawkinsenterprise.com"] [uri "/www/.git/config"] [unique_id "aps2RMmlCidMcg6-LW8SXAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-04 18:40:32
UTC ·
(2 months ago)
[04/Sep/2026:21:40:32 +0300] -- 34.102.70.5 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 18:39:39
UTC ·
(2 months ago)
[ssd5.kdns.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/var/www/.git/config | /backend/.git/config | /app/.git/config
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:52:12
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:52:05.750068 2026] [security2:error] [pid 26433:tid 2643 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.70.5 (5.70.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:52:05.750068 2026] [security2:error] [pid 26433:tid 26433] [client 34.102.70.5:46500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.manty.com"] [uri "/htdocs/.git/config"] [unique_id "apqw5YgIbeGgI3TLEc1T0gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack