🇺🇸
TPI-Abuse
2026-09-03 02:44:07
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 22:44:00.842565 2026] [security2:error] [pid 7772:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 22:44:00.842565 2026] [security2:error] [pid 7772:tid 7772] [client 34.124.141.131:50110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.deckmasterscompany.com"] [uri "/www/.git/config"] [unique_id "apje8Py_YTSfHHbVAkjrlAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-03 02:12:28
UTC ·
(2 months ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-03 01:57:14
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 21:57:09.128026 2026] [security2:error] [pid 11715:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 21:57:09.128026 2026] [security2:error] [pid 11715:tid 11715] [client 34.124.141.131:34758] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.andrewweigel.name"] [uri "/api/.git/config"] [unique_id "apjT9dkMGyyIK9ymxluv9AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
seal
2026-09-03 01:51:25
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
SSH
Brute-Force
🇫🇷
Zundapper
2026-09-03 01:41:03
UTC ·
(2 months ago)
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /api/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep ...
show more
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /api/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /html/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /htdocs/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [03/Sep/2026:03:41:03 +0200] "GET /var/www/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
...
show less
Web App Attack
Port Scan
🇺🇸
TPI-Abuse
2026-09-02 22:41:19
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 18:41:13.116637 2026] [security2:error] [pid 12803:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 18:41:13.116637 2026] [security2:error] [pid 12803:tid 12803] [client 34.124.141.131:34056] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hdeco.com.easternimport.com"] [uri "/site/.git/config"] [unique_id "apimCVhjsqQYDLUdMIjeKQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 19:07:58
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 15:07:51.941359 2026] [security2:error] [pid 5470:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 15:07:51.941359 2026] [security2:error] [pid 5470:tid 5470] [client 34.124.141.131:58248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hazardvillefire.org"] [uri "/wordpress/.git/config"] [unique_id "aph0BwRxwL7sEX69S8RxMgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
OptimusGO
2026-09-02 16:15:38
UTC ·
(2 months ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-09-02 17:15:37 UTC
Log evidence:
34.124.141.131 - - [02/Sep/2026:17:15:36 +0100] "GET /site/.git/config HTTP/1.1" 404 146 "-" "crusader-w ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-09-02 17:15:37 UTC
Log evidence:
34.124.141.131 - - [02/Sep/2026:17:15:36 +0100] "GET /site/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [02/Sep/2026:17:15:36 +0100] "GET /api/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.124.141.131 - - [02/Sep/2026:17:15:36 +0100] "GET /app/.git/config HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
show less
Port Scan
Brute-Force
🇳🇿
Antinson
2026-09-02 10:55:06
UTC ·
(2 months ago)
Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-02 07:37:14
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 03:37:07.550652 2026] [security2:error] [pid 957:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 03:37:07.550652 2026] [security2:error] [pid 957:tid 957] [client 34.124.141.131:48310] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "roguetechscene.com"] [uri "/var/www/.git/config"] [unique_id "apfSI8aTY5J2cpjZw6FvjAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 06:08:16
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 02:08:11.185793 2026] [security2:error] [pid 26808:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.124.141.131 (131.141.124.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 02:08:11.185793 2026] [security2:error] [pid 26808:tid 26808] [client 34.124.141.131:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mailhost.perl-photo.com"] [uri "/htdocs/.git/config"] [unique_id "ape9Sz7p3_VSZSW6DnRr9gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-02 06:03:27
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇴
jad-abuse
2026-09-02 04:36:02
UTC ·
(2 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, scanner_ua. Observed by 1 sensor(s); 12 hits.
Web App Attack
🇨🇭
4server
2026-09-02 04:03:51
UTC ·
(2 months ago)
[WedSep0206:03:45.9323982026][security2:error][pid2123807:tid2125614][client34.124.141.131:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"9607 ...
show more
[WedSep0206:03:45.9323982026][security2:error][pid2123807:tid2125614][client34.124.141.131:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"distributori-automatici-ticino.ch.cadvending.ch\"][uri\"/wordpress/.git/config\"][unique_id\"apegITgztu2bSUZmQcLXswAAAU0\"]
show less
Hacking
Web App Attack
🇸🇪
vaia.cloud
2026-09-02 03:15:01
UTC ·
(2 months ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack