🇳🇱
homeshowdomain.nl
2026-10-28 22:59:25
(1 hour ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-27.
Web App Attack
SSH
Hacking
🇷🇴
clauss
2026-10-27 21:11:42
(1 day ago)
34.20.169.98 - - [27/Oct/2026:23:11:42 +0200] "GET /phpinfo.php HTTP/2.0" 404 20 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:23:11:42 +0200] ...
show more
34.20.169.98 - - [27/Oct/2026:23:11:42 +0200] "GET /phpinfo.php HTTP/2.0" 404 20 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:23:11:42 +0200] "GET /info.php HTTP/2.0" 404 20 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇳🇱
Alt255
2026-10-27 21:01:06
(1 day ago)
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.20.169.98 - - [27/Oct/2026:22:00:56 +0100] "GET /.git/config HTTP/1.1" 404 2125 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ...
show more
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.20.169.98 - - [27/Oct/2026:22:00:56 +0100] "GET /.git/config HTTP/1.1" 404 2125 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-27 18:07:49
(1 day ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-27 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-10-27 17:50:04
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-27 17:31:04
(1 day ago)
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.old HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] " ...
show more
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.old HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.sample HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.example HTTP/1.1" 404 520 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.example HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.169.98 - - [27/Oct/2026:18:31:01 +0100] "GET /.env.dev HTTP/1.1" 404 520 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.
show less
Web App Attack
Hacking
🇺🇸
rafaelpfister.ch
2026-10-27 17:12:20
(1 day ago)
Blocked by WAF: 114 request(s) probing for PHP scripts, WordPress files or secrets on a site without PHP: GET /.env, GET /.env.bak, GET /.env.production, GET /.env.test, GET /.env.staging, GET /.env.development, GET /.env.docker, GET /.env.ci (+106 m ...
show more
Blocked by WAF: 114 request(s) probing for PHP scripts, WordPress files or secrets on a site without PHP: GET /.env, GET /.env.bak, GET /.env.production, GET /.env.test, GET /.env.staging, GET /.env.development, GET /.env.docker, GET /.env.ci (+106 more) • Reported by: github.com/pfstr/cloudflare-abuseipdb-reporter
show less
Web App Attack
🇺🇸
kosada.com
2026-10-27 16:45:51
(1 day ago)
Repeated requests for suspicious nonexistent URLs, for example: /.env.staging (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
Web App Attack
🇳🇱
Savvii
2026-10-27 14:34:27
(1 day ago)
20 attempts against mh_ha-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
ZEROVOX
2026-10-27 14:03:08
(1 day ago)
CrowdSec: crowdsecurity/http-sensitive-files detected
Web App Attack
🇳🇱
middelkoopcc
2026-10-27 13:59:13
(1 day ago)
2026-10-27 14:57:01 GET /.git/config [301] && 2026-10-27 14:57:01 GET /.env [301] && 2026-10-27 14:57:03 GET /.env.bak [301] && 225 more within 20 minutes
Web App Attack
🇳🇱
e.fierstra
2026-10-27 13:49:37
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇧🇷
Peregrine
2026-10-27 13:38:33
(1 day ago)
Fail2Ban Jail:IU tomcat-honeypot | Evidence: 34.20.169.98 104.22.193.31 - - [27/Oct/2026:10:38:31 -0300] "GET /.git/config HTTP/1.1" 404 -
Bad Web Bot
🇺🇸
francelink.fr
2026-10-27 12:03:31
(1 day ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-27T11:21:18.000Z.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 11:48:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.20.169.98 (98.169.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 07:48:48.164498 2026] [security2:error] [pid 25050:tid 25 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.169.98 (98.169.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 07:48:48.164498 2026] [security2:error] [pid 25050:tid 25050] [client 34.20.169.98:45764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "instituteofscience.com"] [uri "/.git/config"] [unique_id "auCPoEjfcUFwgS8oojGw7gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
