🇸🇪
vaia.cloud
2026-11-12 07:10:02
UTC ·
(2 days ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-12 01:17:07
UTC ·
(3 days ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.15.168.44 - - [12/Nov/2026:02:16:42 +0100] "GET /.git/config HTTP/1.1" 301 622 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.15.168.44 - - [12/Nov/2026:02:16:42 +0100] "GET /.git/config HTTP/1.1" 301 622 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-11-11 07:53:31
UTC ·
(3 days ago)
[WedNov1108:53:29.4854572026][security2:error][pid3870649:tid3870700][client34.15.168.44:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacce ...
show more
[WedNov1108:53:29.4854572026][security2:error][pid3870649:tid3870700][client34.15.168.44:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"aesthetia.ch.136-243-54-122.cpanel.site\"][uri\"/phpinfo.php.bak\"][unique_id\"avQe-W2tuEuMeIOJ-A7iMAAAAEQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-11 06:04:44
UTC ·
(3 days ago)
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.15.168.44 - - \[11/Nov/2026:07:04:40 +0100\] "GET /.git/config HTTP/1.1" 404 2176 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, ...
show more
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.15.168.44 - - \[11/Nov/2026:07:04:40 +0100\] "GET /.git/config HTTP/1.1" 404 2176 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-11 02:50:05
UTC ·
(4 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇦🇺
2000cn.com.au
2026-11-11 02:30:38
UTC ·
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇦
URAN Publishing Service
2026-11-11 00:58:45
UTC ·
(4 days ago)
[11/Nov/2026:02:58:44 +0200] -- 34.15.168.44 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-10 22:00:43
UTC ·
(4 days ago)
Try to access /.git/config
Web App Attack
🇩🇪
Mr-Money
2026-11-10 17:49:46
UTC ·
(4 days ago)
scenario: crowdsecurity/http-sensitive-files - events: 5
Web App Attack
Hacking
🇩🇪
Hazzard
2026-11-10 09:11:27
UTC ·
(4 days ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇳🇱
Alt255
2026-11-10 07:18:46
UTC ·
(4 days ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.15.168.44 - - [10/Nov/2026:08:18:32 +0100] "GET /.git/config HTTP/1.1" 404 2104 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.15.168.44 - - [10/Nov/2026:08:18:32 +0100] "GET /.git/config HTTP/1.1" 404 2104 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-11-10 06:00:43
UTC ·
(4 days ago)
34.15.168.44 - - [10/Nov/2026:17:00:42 +1100] "GET /.git/config HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384
34.15.168.44 - - [10/Nov/2026 ...
show more
34.15.168.44 - - [10/Nov/2026:17:00:42 +1100] "GET /.git/config HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384
34.15.168.44 - - [10/Nov/2026:17:00:43 +1100] "GET /.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384
34.15.168.44 - - [10/Nov/2026:17:00:43 +1100] "GET /.env.local HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384
...
show less
Bad Web Bot
🇯🇵
S.O.B.A. Dev.
2026-11-10 04:09:51
UTC ·
(5 days ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack
🇩🇪
hotzmatic
2026-11-10 01:29:54
UTC ·
(5 days ago)
None (228 events observed on private honeypot sensor)
Hacking
🇫🇷
masterguru
2026-11-10 00:00:48
UTC ·
(5 days ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
