🇫🇷
masterguru
2026-09-29 00:39:54
UTC ·
(1 month ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.28.158.104 (US/United States/104.158.28.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
Hacking
🇳🇱
Site.eu
2026-09-26 23:55:27
UTC ·
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇫🇷
mail.avx.gr
2026-09-26 23:16:32
UTC ·
(1 month ago)
(nginxENVSCAN) nginx environment-file scanner detected from 34.28.158.104 (US/United States/Iowa/Council Bluffs/104.158.28.34.bc.googleusercontent.com)
Hacking
🇺🇸
TPI-Abuse
2026-09-26 16:33:05
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 12:32:55.716031 2026] [security2:error] [pid 28217:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 12:32:55.716031 2026] [security2:error] [pid 28217:tid 28217] [client 34.28.158.104:32898] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blog.needtoorder.com"] [uri "/.git/config"] [unique_id "arfzt-_aFeG_eO3J5iKX2AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 08:49:31
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 04:49:24.381130 2026] [security2:error] [pid 20503:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 04:49:24.381130 2026] [security2:error] [pid 20503:tid 20503] [client 34.28.158.104:47634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thegrabbagshow.com"] [uri "/.git/config"] [unique_id "areHFGjwIj0ODUh-2ZAvTAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-26 07:41:32
UTC ·
(1 month ago)
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please ...
show more
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /.git/config | 2026-09-26 07:41 UTC
show less
Hacking
Web App Attack
2026-09-25 02:49:07
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-09-25 02:32:59
UTC ·
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-24 18:06:31
UTC ·
(1 month ago)
Excessive 404/403 errors
Brute-Force
🇩🇪
ghostwarriors
2026-09-24 01:50:07
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-24 01:39:31
UTC ·
(1 month ago)
34.28.158.104 - - [24/Sep/2026:03:39:27 +0200] "GET /.env.remote HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:27 +0200] "GET /.env.b ...
show more
34.28.158.104 - - [24/Sep/2026:03:39:27 +0200] "GET /.env.remote HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:27 +0200] "GET /.env.bak HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:28 +0200] "GET /.env.backup HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:28 +0200] "GET /.env.save HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:28 +0200] "GET /.env.old HTTP/1.1" 404 514 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.28.158.104 - - [24/Sep/2026:03:39:28 +0200] "GET /
show less
Web App Attack
Hacking
🇪🇸
robotstxt
2026-09-23 10:59:18
UTC ·
(1 month ago)
34.28.158.104 - - [23/Sep/2026:10:58:31 +0000] "POST / HTTP/1.1" 403 14733 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.28.158.104"
34.28.158.104 - - [23/Sep/ ...
show more
34.28.158.104 - - [23/Sep/2026:10:58:31 +0000] "POST / HTTP/1.1" 403 14733 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.28.158.104"
34.28.158.104 - - [23/Sep/2026:10:58:31 +0000] "POST / HTTP/1.1" 403 14733 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.28.158.104"
34.28.158.104 - - [23/Sep/2026:10:58:31 +0000] "GET /.git/config HTTP/1.1" 403 12594 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.28.158.104"
34.28.158.104 - - [23/Sep/2026:10:58:32 +0000] "GET /.env HTTP/1.1" 403 12594 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.28.158.104"
34.28.158.104 - - [23/Sep/2026:10:58:32 +0000] "GET /.env.local HTTP/1.1" 403 12594 "-" "Mo
...
show less
Web App Attack
2026-09-22 11:32:47
UTC ·
(1 month ago)
Flagged as abuse by IisGuard automated detection (tier L3, score 65/100). Reasons: Reputation=1, BadPath=23,9, Rate=20, Diversity=20.
Web App Attack
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-21 23:25:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:25:18.356154 2026] [security2:error] [pid 22208:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:25:18.356154 2026] [security2:error] [pid 22208:tid 22208] [client 34.28.158.104:43500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thoughtworm.com"] [uri "/.git/config"] [unique_id "arG83puIWqPFcE0zEDnYtAAAAGs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 19:49:49
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 15:49:43.953992 2026] [security2:error] [pid 29483:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.158.104 (104.158.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 15:49:43.953992 2026] [security2:error] [pid 29483:tid 29483] [client 34.28.158.104:38358] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wailthelifeofbudpowell.com"] [uri "/.git/config"] [unique_id "arA41xA2JIfi5oC5wM42YQAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
