🇨🇭
TheCoon
2026-05-29 05:15:01
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇺🇸
Major Hostility
2026-05-28 10:24:17
(2 weeks ago)
"GET /app/.env HTTP/1.1" 404
"GET /.env.save HTTP/1.1" 404
Web App Attack
🇯🇵
Tom Tamagawa
2026-05-28 09:12:00
(2 weeks ago)
Probing for vulnerabilities
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-05-28 08:50:06
(2 weeks ago)
Probing for .env file:
34.131.177.157 - - [28/May/2026:10:50:04 +0200] "GET /.env.backup HTTP/2.0" 4 ...
show more
Probing for .env file:
34.131.177.157 - - [28/May/2026:10:50:04 +0200] "GET /.env.backup HTTP/2.0" 400 230 "-" "Mozilla/5.0 (compatible; Crusader/1.0)"
show less
Web App Attack
🇺🇸
itsnixk
2026-05-28 06:34:50
(2 weeks ago)
(mod_security) mod_security (id:920350) triggered by 34.131.177.157 (IN/India/157.177.131.34.bc.goog ...
show more
(mod_security) mod_security (id:920350) triggered by 34.131.177.157 (IN/India/157.177.131.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu May 28 02:34:44.532125 2026] [security2:error] [pid 944380:tid 944821] [client 34.131.177.157:51502] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "774"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "ahfiBK9sXuTJse-l0tMM4wAAANI"]
show less
Port Scan
2026-05-28 03:34:58
(2 weeks ago)
Aggressive web scan
Web App Attack
🇺🇸
heyzg
2026-05-28 02:09:10
(2 weeks ago)
HTTP honeypot | Web Scanning | 124 HTTP, 1.4m
Bad Web Bot
Web App Attack
🇧🇪
Saec
2026-05-27 08:00:07
(3 weeks ago)
Jarvis auto-ban: CF honeypot path /.git/config (1× on saec.me)
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 07:18:16
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 03:18:10.915057 2026] [security2:error] [pid 32627:tid 32627] [client 34.131.177.157:49522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.outofthebluephotography.com"] [uri "/.git/config"] [unique_id "ahaaspxMtbgIgPF3XrgReQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 06:22:04
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 02:21:58.639548 2026] [security2:error] [pid 17593:tid 17593] [client 34.131.177.157:33702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thepianosmith.com"] [uri "/.git/config"] [unique_id "ahaNhnKEKxhJggqoGqJUuAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 06:06:20
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 02:06:14.008604 2026] [security2:error] [pid 25339:tid 25339] [client 34.131.177.157:45840] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.austingrammer.com"] [uri "/.git/config"] [unique_id "ahaJ1svfdG3oEiWgj_ROIQAAAIw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 05:46:27
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 01:46:21.498223 2026] [security2:error] [pid 4109:tid 4109] [client 34.131.177.157:59652] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.davidocchino.com"] [uri "/.git/config"] [unique_id "ahaFLUDeCMMlXjyITM-P-AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 04:52:54
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 00:52:48.291172 2026] [security2:error] [pid 31114:tid 31114] [client 34.131.177.157:40440] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dansplans.com"] [uri "/.git/config"] [unique_id "ahZ4oM2pJb0Izb0WLxvErgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
bcsaba
2026-05-27 04:39:15
(3 weeks ago)
Probing for .git:
34.131.177.157 - - [27/May/2026:06:39:14 +0200] "GET /.git/config HTTP/1.1" 400 63 ...
show more
Probing for .git:
34.131.177.157 - - [27/May/2026:06:39:14 +0200] "GET /.git/config HTTP/1.1" 400 632 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3875.0 Safari/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 04:36:17
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.131.177.157 (157.177.131.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 00:36:09.785103 2026] [security2:error] [pid 7126:tid 7126] [client 34.131.177.157:39906] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.transportdelivery.com"] [uri "/.git/config"] [unique_id "ahZ0udZ7ESS9xfTb8BKQbAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack