2026-09-30 10:37:46
UTC ·
(1 month ago)
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
Web App Attack
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-09-29 22:25:00
UTC ·
(1 month ago)
Brute-Force
Web App Attack
2026-09-29 22:09:49
UTC ·
(1 month ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
2026-09-29 10:34:21
UTC ·
(1 month ago)
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-29 00:06:43
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.159.36.231 (231.36.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 20:06:36.417094 2026] [security2:error] [pid 16028:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.36.231 (231.36.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 20:06:36.417094 2026] [security2:error] [pid 16028:tid 16028] [client 34.159.36.231:56522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.copierscharlotte.com"] [uri "/.git/config"] [unique_id "arsBDDqVOpDIEW5Ri7bw2gAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-28 22:24:20
UTC ·
(1 month ago)
Brute-Force
Web App Attack
2026-09-28 21:13:12
UTC ·
(1 month ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-28 04:41:16
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.159.36.231 (231.36.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 00:41:12.312984 2026] [security2:error] [pid 20943:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.36.231 (231.36.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 00:41:12.312984 2026] [security2:error] [pid 20943:tid 20943] [client 34.159.36.231:58202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "financas.raphacb.com"] [uri "/.git/config"] [unique_id "arnv6CWD5dhjB3GP-bjSywAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-09-28 04:27:40
UTC ·
(1 month ago)
2026/09/28 04:27:39 [error] 17007#17007: *43944270 access forbidden by rule, client: 34.159.36.231, server: finami.ph, request: "GET /.git/config HTTP/2.0", host: "finami.ph"
2026/09/28 04:27:39 [error] 17007#17007: *43944270 access forbidden by rule ...
show more
2026/09/28 04:27:39 [error] 17007#17007: *43944270 access forbidden by rule, client: 34.159.36.231, server: finami.ph, request: "GET /.git/config HTTP/2.0", host: "finami.ph"
2026/09/28 04:27:39 [error] 17007#17007: *43944270 access forbidden by rule, client: 34.159.36.231, server: finami.ph, request: "GET /.env HTTP/2.0", host: "finami.ph"
2026/09/28 04:27:39 [error] 17008#17008: *43960297 access forbidden by rule, client: 34.159.36.231, server: finami.ph, request: "GET /.env.local HTTP/2.0", host: "finami.ph"
...
show less
Web App Attack
🇩🇪
big-cloud.nl
2026-09-27 15:13:24
UTC ·
(1 month ago)
Try to access /.git/config
Web App Attack
🇩🇪
4server
2026-09-26 10:04:23
UTC ·
(1 month ago)
[SatSep2612:04:20.4763262026][security2:error][pid2113396:tid2113427][client34.159.36.231:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\} ...
show more
[SatSep2612:04:20.4763262026][security2:error][pid2113396:tid2113427][client34.159.36.231:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"fondazionepetronillapontirone.ch\"][uri\"/\"][unique_id\"areYpMahqEGhi2KUUxu22QAAAAs\"]
show less
Port Scan
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-09-26 09:44:18
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
dynamix
2026-09-26 09:19:53
UTC ·
(1 month ago)
Multiple WAF Violations
Web App Attack
🇩🇪
Blexyel
2026-09-26 08:16:12
UTC ·
(1 month ago)
34.159.36.231 - - [26/Sep/2026:10:16:11 +0200] "GET /.git/config HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
Brute-Force
Web App Attack
🇪🇸
robotstxt
2026-09-26 07:47:29
UTC ·
(1 month ago)
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.env HTTP/1.1" 403 18050 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.159.36.231"
34.159.36.231 - - [26/Sep/2026:07:46:27 ...
show more
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.env HTTP/1.1" 403 18050 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.159.36.231"
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.env.local HTTP/1.1" 403 18050 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.159.36.231"
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.git/config HTTP/1.1" 403 18051 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.159.36.231"
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.env.production HTTP/1.1" 403 18050 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.159.36.231"
34.159.36.231 - - [26/Sep/2026:07:46:27 +0000] "GET /.env.staging HTTP/1.1" 403 18050 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebK
...
show less
Web App Attack
