๐ณ๐ฑ
Webhoster
2026-10-19 06:40:08
(12 hours ago)
HTTP sensitive-file probing detected by Fail2Ban (traefik-http).
Source: 34.18.168.5. Evidence: 2 ma ...
show more
HTTP sensitive-file probing detected by Fail2Ban (traefik-http).
Source: 34.18.168.5. Evidence: 2 matching request(s).
UTC: 2026-10-19 06:40:07 to 2026-10-19 06:40:07.
Observed requests (query strings omitted):
GET /.git/config -> HTTP 403 (1x)
GET /.env -> HTTP 403 (1x)
show less
Web App Attack
๐บ๐ธ
grassyloki
2026-10-19 06:32:30
(12 hours ago)
Rapid sensitive-file enumeration: 15+ sequential requests for .env/* variants and .git/config, all b ...
show more
Rapid sensitive-file enumeration: 15+ sequential requests for .env/* variants and .git/config, all blocked 403.
Target: HTTPS 443; GET /.env, /.a host, /.env.backup, /.git/config and 10+ other .env variants
Seen: 2026-10-19 02:32 EDT
- 2026-10-19 02:32:32 GET /.env HTTP/1.1 -> 403, host=a host, UA Chrome/131.0.0.0
- 2026-10-19 02:32:32 GET /.a host HTTP/1.1 -> 403, host=a host
- 2026-10-19 02:32:33 GET /.env.backup HTTP/1.1 -> 403, host=a host
- 2026-10-19 02:32:31 GET /.git/config HTTP/1.1 -> 403, host=a host
- 02:32:30-02:32:34 rapid enumeration of /.env, /.a host, /.env.dev, /.env.example, /.env.sample, /.env.save, /.env.bak, /.env.remote, /.env.test, /.env.development, /.env.staging, /.env.production, /.env.old (all 403)
- Source IP 34.18.168.5 also seen rule http-sensitive-files and npm-scanner for .env/.git probing
show less
Web App Attack
๐ต๐ฑ
sigurg
2026-10-19 06:02:23
(12 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
๐ฆ๐น
SchiWaGoA
2026-10-19 05:31:00
(13 hours ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
๐ฉ๐ฐ
Leif Neland
2026-10-19 05:00:08
(13 hours ago)
Detected by CrowdSec on slim
Brute-Force
๐ซ๐ท
Nop Nop
2026-10-19 04:35:53
(14 hours ago)
CrowdSec ban: crowdsecurity/http-sensitive-files
Port Scan
๐ฉ๐ช
mravb
2026-10-19 04:32:14
(14 hours ago)
34.18.168.5 - - [19/Oct/2026:07:32:13 +0300] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11 ...
show more
34.18.168.5 - - [19/Oct/2026:07:32:13 +0300] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
Hacking
๐ช๐ธ
yvoictra
2026-10-19 04:16:40
(14 hours ago)
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.git/config HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Ma ...
show more
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.git/config HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.env.local HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.env.production HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.168.5 - - [19/Oct/2026:06:16:40 +0200] "GET /.env.staging HTTP/1.1" 404 14 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.
...
show less
Brute-Force
Web App Attack
๐ฆ๐บ
Klaverstyn
2026-10-19 03:53:25
(14 hours ago)
Cross-vhost secrets/RCE probing campaign
Web App Attack
Hacking
๐ต๐ฑ
bmino.pl
2026-10-19 03:07:10
(15 hours ago)
Autoban IP(2): 34.18.168.5 - Hostname: Google LLC - City: Doha - Country: Qatar - Organization: Goog ...
show more
Autoban IP(2): 34.18.168.5 - Hostname: Google LLC - City: Doha - Country: Qatar - Organization: Google Cloud (me-central1) - Reason: GET /.git/config HTTP/1.1
show less
Web App Attack
๐ฉ๐ช
Hary74656
2026-10-19 03:01:38
(15 hours ago)
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 34.18.168.5] [realclient 3 ...
show more
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 34.18.168.5] [realclient 34.18.168.5] [19/Oct/2026:05:01:37 +0200] [vhost ha.aschi.at] 403 "GET /.git/config HTTP/1.1"
show less
Web App Attack
Anonymous
2026-10-18 19:06:20
(23 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack