🇩🇪
Dominik Lysiak
2026-11-06 11:31:00
UTC ·
(6 minutes ago)
34.186.198.0 - - [06/Nov/2026:12:30:58 +0100] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.186.198.0 - - [06/Nov/2026:12:30:59 +0100 ...
show more
34.186.198.0 - - [06/Nov/2026:12:30:58 +0100] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.186.198.0 - - [06/Nov/2026:12:30:59 +0100] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.186.198.0 - - [06/Nov/2026:12:30:59 +0100] "GET /.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
Blexyel
2026-11-06 10:53:15
UTC ·
(44 minutes ago)
34.186.198.0 - - [06/Nov/2026:11:53:14 +0100] "GET /.git/config HTTP/1.1" 404 120 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
Brute-Force
Web App Attack
🇺🇸
abenage
2026-11-06 10:41:37
UTC ·
(55 minutes ago)
34.186.198.0 - - [06/Nov/2026:03:41:36 -0700] "GET /phpinfo.php HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
Bad Web Bot
Web App Attack
🇨🇭
beatsnet.com
2026-11-06 10:38:45
UTC ·
(58 minutes ago)
[Fri Nov 06 11:38:44.010874 2026] [authz_core:error] [pid 73517:tid 56174364422160] [client 34.186.198.0:37182] AH01630: client denied by server configuration: /usr/local/www/apache24/data/mta-sts/.git
[Fri Nov 06 11:38:44.344072 2026] [authz_core:er ...
show more
[Fri Nov 06 11:38:44.010874 2026] [authz_core:error] [pid 73517:tid 56174364422160] [client 34.186.198.0:37182] AH01630: client denied by server configuration: /usr/local/www/apache24/data/mta-sts/.git
[Fri Nov 06 11:38:44.344072 2026] [authz_core:error] [pid 73517:tid 56174364422160] [client 34.186.198.0:37182] AH01630: client denied by server configuration: /usr/local/www/apache24/data/mta-sts/.env
[Fri Nov 06 11:38:44.495433 2026] [authz_core:error] [pid 73517:tid 56174364422160] [client 34.186.198.0:37182] AH01630: client denied by server configuration: /usr/local/www/apache24/data/mta-sts/.env.local
[Fri Nov 06 11:38:44.710594 2026] [authz_core:error] [pid 73517:tid 56174364422160] [client 34.186.198.0:37182] AH01630: client denied by server configuration: /usr/local/www/apache24/data/mta-sts/.env.production
...
show less
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-11-06 10:29:23
UTC ·
(1 hour ago)
Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-11-06 10:24:59
UTC ·
(1 hour ago)
2026/11/06 10:24:51 [error] 3084#3084: *1140565 access forbidden by rule, client: 34.186.198.0, server: [redacted], request: "GET /.env HTTP/1.1", host: "mta-sts.[redacted]"
34.186.198.0 - - [06/Nov/2026:10:24:51 +0000] "GET /.env HTTP/1.1" 403 1178 ...
show more
2026/11/06 10:24:51 [error] 3084#3084: *1140565 access forbidden by rule, client: 34.186.198.0, server: [redacted], request: "GET /.env HTTP/1.1", host: "mta-sts.[redacted]"
34.186.198.0 - - [06/Nov/2026:10:24:51 +0000] "GET /.env HTTP/1.1" 403 1178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
2026/11/06 10:24:57 [error] 3084#3084: *1140565 access forbidden by rule, client: 34.186.198.0, server: [redacted], request: "GET /app/.env HTTP/1.1", host: "mta-sts.[redacted]"
show less
Brute-Force
Web App Attack
🇫🇷
phoenix1jl96
2026-11-06 10:11:00
UTC ·
(1 hour ago)
2026/11/06 11:11:00 [error] 2581721#2581721: *405655 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.186.198.0, server: mta-sts.aqteeve.fr, request: "GET /mailer/.env HTTP/1.1", host: "mta-sts.aqteev ...
show more
2026/11/06 11:11:00 [error] 2581721#2581721: *405655 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.186.198.0, server: mta-sts.aqteeve.fr, request: "GET /mailer/.env HTTP/1.1", host: "mta-sts.aqteeve.fr"
2026/11/06 11:11:00 [error] 2581721#2581721: *405656 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.186.198.0, server: mta-sts.aqteeve.com, request: "GET /mailer/.env HTTP/1.1", host: "mta-sts.aqteeve.com"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇵🇱
strefapi_com
2026-11-06 10:01:09
UTC ·
(1 hour ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇩🇪
curiosity
2026-11-06 09:57:15
UTC ·
(1 hour ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
2026-11-06 09:30:59
UTC ·
(2 hours ago)
Scenarios: http-probing, http-sensitive-files
Total requests: 41
Web App Attack
2026-11-06 03:00:19
UTC ·
(8 hours ago)
Auto-reported by Fail2Ban (NPM-Auth)
Web App Attack
🇩🇪
4server
2026-11-05 21:49:46
UTC ·
(13 hours ago)
[ThuNov0522:49:41.5561992026][security2:error][pid432536:tid432715][client34.186.198.0:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\ ...
show more
[ThuNov0522:49:41.5561992026][security2:error][pid432536:tid432715][client34.186.198.0:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"mail.risanamento-pareti-umide-ticino.ch\"][uri\"/\"][unique_id\"auz59dYNOoW5G01WPA-7jQAAAA8\"]
show less
Port Scan
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-11-05 21:05:08
UTC ·
(14 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-11-05 20:47:13
UTC ·
(14 hours ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x2; 1 domain(s) in 15s
Web App Attack
🇩🇪
FD-IX
2026-11-05 18:33:48
UTC ·
(17 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
