🇳🇱
homeshowdomain.nl
2026-05-02 22:08:11
UTC ·
(6 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-01.
Web App Attack
SSH
Hacking
🇮🇳
evicky2002
2026-05-02 06:00:00
UTC ·
(6 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-05-01 06:43:56
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 02:43:48.950067 2026] [security2:error] [pid 27773:tid 2777 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 02:43:48.950067 2026] [security2:error] [pid 27773:tid 27773] [client 34.118.7.39:38326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ageh.com"] [uri "/.git/config"] [unique_id "afRLpGaYTQe5J1smgdPGzwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
kranem
2026-05-01 06:01:19
UTC ·
(6 months ago)
Triggered Cloudflare WAF from PL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
Timestamp: 2026-05-01T03:49:14Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gec ...
show more
Triggered Cloudflare WAF from PL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
Timestamp: 2026-05-01T03:49:14Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-01 04:22:11
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 00:22:04.125481 2026] [security2:error] [pid 6594:tid 6594] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 00:22:04.125481 2026] [security2:error] [pid 6594:tid 6594] [client 34.118.7.39:41228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "livinghopehighschool.org"] [uri "/.git/config"] [unique_id "afQqbIOtmflwaJN3hZ1m3gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 03:48:37
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 23:48:33.736805 2026] [security2:error] [pid 15335:tid 1533 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 23:48:33.736805 2026] [security2:error] [pid 15335:tid 15335] [client 34.118.7.39:34566] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.spacebooger.com"] [uri "/.git/config"] [unique_id "afQikdYClVIqYb9WrjHg3gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 02:56:50
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 22:56:46.178768 2026] [security2:error] [pid 3630:tid 3630] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 22:56:46.178768 2026] [security2:error] [pid 3630:tid 3630] [client 34.118.7.39:33104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "onlinesuretybonds.com"] [uri "/.git/config"] [unique_id "afQWbonYafNWUN9zfGuoKwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
securejdprop
2026-05-01 02:25:04
UTC ·
(6 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 34.118.7.39 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-05-01 02:25:03.946256926 +0000 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 01:35:55
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 21:35:49.411527 2026] [security2:error] [pid 2970:tid 2970] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 21:35:49.411527 2026] [security2:error] [pid 2970:tid 2970] [client 34.118.7.39:56056] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "capitallawgroup.progressivefileshare.org"] [uri "/.git/config"] [unique_id "afQDdVemnoQ9m8617zRqFAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-01 01:18:04
UTC ·
(6 months ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1
Hacking
Web App Attack
2026-05-01 00:36:13
UTC ·
(6 months ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 00:35:58
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 20:35:52.514110 2026] [security2:error] [pid 27801:tid 2780 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 20:35:52.514110 2026] [security2:error] [pid 27801:tid 27801] [client 34.118.7.39:44138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crooked1826.org"] [uri "/.git/config"] [unique_id "afP1aNndrJa8LRFIykhOcAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
securejdprop
2026-05-01 00:35:34
UTC ·
(6 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 34.118.7.39 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-05-01 00:35:33.639572881 +0000 UTC
Hacking
Web App Attack
2026-05-01 00:20:28
UTC ·
(6 months ago)
34.118.7.39 - - [01/May/2026:08:20:27 +0800] "GET /.git/config HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 8.1.0; LM-Q925S) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-01 00:05:55
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 20:05:49.491051 2026] [security2:error] [pid 4565:tid 4676] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.118.7.39 (39.7.118.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 20:05:49.491051 2026] [security2:error] [pid 4565:tid 4676] [client 34.118.7.39:51142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "retrieversocal.com.ceol.us"] [uri "/.git/config"] [unique_id "afPuXVqrD39Zq5njWEOE-QAAAkI"]
show less
Brute-Force
Bad Web Bot
Web App Attack