🇳🇱
homeshowdomain.nl
2026-11-03 23:03:00
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-02.
Web App Attack
SSH
Hacking
Anonymous
2026-11-03 12:07:15
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
Anonymous
2026-11-02 16:25:29
UTC ·
(1 week ago)
34.19.179.196 - - [02/Nov/2026:17:25:28 +0100] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
34.19.179.196 - - [02/Nov/2026:17:25:28 +0100] ...
show more
34.19.179.196 - - [02/Nov/2026:17:25:28 +0100] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
34.19.179.196 - - [02/Nov/2026:17:25:28 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
34.19.179.196 - - [02/Nov/2026:17:25:28 +0100] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.19.179.196 - - [02/Nov/2026:17:25:29 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.19.179.196 - - [02/Nov/2026:17:25:29 +0100] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
...
show less
Brute-Force
SSH
Anonymous
2026-11-02 14:45:19
UTC ·
(1 week ago)
Observed scanned 335 known-sensitive endpoint(s), e.g.: /%2eenv, /....//....//....//..../.env, /....//....//....//..../proc/self/environ, /.//.env, /.amplifyrc, /.aws/config
Bad Web Bot
Web App Attack
Anonymous
2026-11-02 14:10:22
UTC ·
(1 week ago)
34.19.179.196 - - [02/Nov/2026:15:10:21 +0100] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.19.179.196 - - [02/Nov/2026:1 ...
show more
34.19.179.196 - - [02/Nov/2026:15:10:21 +0100] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.19.179.196 - - [02/Nov/2026:15:10:21 +0100] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron HTTP/2.0" 404 265 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.19.179.196 - - [02/Nov/2026:15:10:21 +0100] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.19.179.196 - - [02/Nov/2026:15:10:21 +0100] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.19.179.196 - - [02/Nov/2026
...
show less
Brute-Force
SSH
Anonymous
2026-11-02 12:56:57
UTC ·
(1 week ago)
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2. ...
show more
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.19.179.196 - - [02/Nov/2026:13:56:56 +0100] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Brute-Force
SSH
🇳🇱
Alt255
2026-11-02 12:14:17
UTC ·
(1 week ago)
[cb-03al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.19.179.196 - - [02/Nov/2026:13:14:11 +0100] "GET /.env.dev.local HTTP/2.0" 403 346 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@b ...
show more
[cb-03al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.19.179.196 - - [02/Nov/2026:13:14:11 +0100] "GET /.env.dev.local HTTP/2.0" 403 346 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-11-02 11:48:00
UTC ·
(1 week ago)
IPBlock protected site ID [3390-wh].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
Anonymous
2026-11-02 11:46:22
UTC ·
(1 week ago)
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /..%2f..%2f.env HTTP/2.0 ...
show more
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.19.179.196 - - [02/Nov/2026:12:46:22 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatib
...
show less
Brute-Force
SSH
🇩🇪
Hazzard
2026-11-02 11:37:09
UTC ·
(1 week ago)
(PERMBLOCK) 34.19.179.196 (CA/Canada/Quebec/Montreal/196.179.19.34.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
Hacking
🇿🇦
Megasurf
2026-11-02 11:26:33
UTC ·
(1 week ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
Web App Attack
🇩🇪
4server
2026-11-02 11:15:22
UTC ·
(1 week ago)
[MonNov0212:15:18.7380362026][security2:error][pid3817472:tid3817594][client34.19.179.196:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:queryintrospectionquery\?\|__schema\\\\\\\\\?{\?\(\?:querytype\|types\?\)\)\?\\\\\\\\{\"atREQ ...
show more
[MonNov0212:15:18.7380362026][security2:error][pid3817472:tid3817594][client34.19.179.196:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:queryintrospectionquery\?\|__schema\\\\\\\\\?{\?\(\?:querytype\|types\?\)\)\?\\\\\\\\{\"atREQUEST_BODY.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"234\"][id\"344378\"][rev\"2\"][msg\"Atomicorp.comWAFRules:GraphQLInjectionAttackattempt\"][data\"MatchedData:__schema{types{foundwithinREQUEST_BODY:{\\\\x22query\\\\x22:\\\\x22{__schema{types{namefields{nameargs{namedefaultvalue}}}}}\\\\x22}\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"spazi-web-hosting.ch\"][uri\"/graphql\"][unique_id\"auhwxiBMtSCoWY_WnZKfWAAAAQo\"]\,referer:https://spazi-web-hosting.ch
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
grassyloki
2026-11-02 10:54:00
UTC ·
(1 week ago)
Path-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTTP 80, vhost ai.thlok.tech: ../../../../proc/self/environ, /files../.env, /.output/server/index.mjs, /api/fs/read path traversal
Seen: 2026-11-02 05:54 ...
show more
Path-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTTP 80, vhost ai.thlok.tech: ../../../../proc/self/environ, /files../.env, /.output/server/index.mjs, /api/fs/read path traversal
Seen: 2026-11-02 05:54 EST
- 05:54:22 GET /static/../../../a/../../../../proc/self/environ HTTP/1.1 -> 400 (IDS web attack)
- 05:54:25 GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/1.1 -> 400
- 05:54:20 GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1 -> 403
- 05:54:19 GET /files../.env HTTP/1.1 -> 403; GET /.output/server/index.mjs -> 403; all env/config probes denied
show less
Web App Attack
Anonymous
2026-11-02 10:40:43
UTC ·
(1 week ago)
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /%2E%2E ...
show more
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
34.19.179.196 - - [02/Nov/2026:11:40:42 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
show less
Brute-Force
SSH
Anonymous
2026-11-02 10:16:13
UTC ·
(1 week ago)
Bot / seems abusive / Apache connections: 43
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack