๐ธ๐ฌ
Starburst SysOp Team
2026-06-26 02:34:55
(2 months ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-sin2-2)
Hacking
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-06-26 02:26:15
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 22:26:11.491138 2026] [security2:error] [pid 13651:tid 13651] [client 34.21.246.25:35074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "usbea.com"] [uri "/app/.git/config"] [unique_id "aj3jQzlurFc-CCU6jxsoTAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
slay3r9903
2026-06-26 01:56:10
(2 months ago)
IP address blocked by Cloudflare security rules due to suspicious activity and security violations.
Hacking
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-06-26 00:43:13
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 20:43:06.888957 2026] [security2:error] [pid 22860:tid 22860] [client 34.21.246.25:48966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "b2c-llc.com"] [uri "/src/.git/config"] [unique_id "aj3LGubdH2i22V24AWLRwwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-06-25 23:53:38
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.246.25 (25.246.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 19:53:35.105117 2026] [security2:error] [pid 9608:tid 9608] [client 34.21.246.25:56636] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.musicwithsteve.com"] [uri "/backend/.git/config"] [unique_id "aj2_f3W27Xkm-0ObenARswAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐น
AlienBase
2026-06-25 22:26:00
(2 months ago)
34.21.246.25 - - [25/Jun/2026:16:58:48 +0000] "GET /app/.git/config HTTP/1.1" 403 548 "-" "Mozilla/5 ...
show more
34.21.246.25 - - [25/Jun/2026:16:58:48 +0000] "GET /app/.git/config HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Linux; Android 8.0.0; HTC U11 plus) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
34.21.246.25 - - [25/Jun/2026:16:58:48 +0000] "GET /src/.git/config HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko/20081015 Fennec/1.0a1"
34.21.246.25 - - [25/Jun/2026:16:58:48 +0000] "GET /api/.git/config HTTP/1.1" 403 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.158 Safari/537.36 Vivaldi/2.5.1525.43"
34.21.246.25 - - [25/Jun/2026:16:58:48 +0000] "GET /v1/.git/config HTTP/1.1" 403 146 "-" "Mozilla/5.0 (Linux; U; Android 1.5; en-us; T-Mobile G1 Build/CRB43) AppleWebKit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari 525.20.1"
show less
Bad Web Bot
Exploited Host
Web App Attack
Hacking
๐ณ๐ฑ
Savvii
2026-06-25 16:32:51
(2 months ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
๐ฌ๐ง
Artelis
2026-06-25 14:57:40
(2 months ago)
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 ( ...
show more
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Lenovo P1a42) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /src/.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Linux; Android 9; SM-M305F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /backend/.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /app/.git/config HTTP/1.1" 404 146 "-" "Nokia6100/1.0 (04.01) Profile/MIDP-1.0 Configuration/CLDC-1.0"
34.21.246.25 - - [25/Jun/2026:14:57:39 +0000] "GET /frontend/.git/config HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Linux; Android 9; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Saf
...
show less
Web App Attack
๐ต๐ฑ
TaKeN
2026-06-25 13:20:39
(2 months ago)
Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application pr ...
show more
Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing from this source IP. Observed 2 matching blocked event(s) between 2026-06-25T15:20:39+02:00 and 2026-06-25T15:20:39+02:00. Sample requested paths: /htdocs/.git/config, /symfony/.git/config.
show less
Web App Attack
Hacking
๐ณ๐ฑ
Savvii
2026-06-25 12:41:26
(2 months ago)
30 attempts against mh-misbehave-ban on plum
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
dynamix
2026-06-25 12:24:32
(2 months ago)
Multiple WAF Violations
Web App Attack