🇨🇭
ca
2026-09-07 10:12:17
(5 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-07 07:46:09
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 03:46:02.155224 2026] [security2:error] [pid 24582:tid 24582] [client 34.29.157.66:48076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.purpleweddingnapkins.com"] [uri "/.git/config"] [unique_id "ap5runpe4LjMEK3ag-3iZwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-09-07 07:30:34
(7 hours ago)
80,443
Brute-Force
SSH
🇳🇱
e.fierstra
2026-09-07 07:23:51
(7 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
Anonymous
2026-09-07 06:55:46
(8 hours ago)
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:40 -0600] "GET /.git/config HTTP/1.1" 403 158 " ...
show more
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:40 -0600] "GET /.git/config HTTP/1.1" 403 158 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:40 -0600] "GET /.env HTTP/1.1" 404 606627 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:41 -0600] "GET /.env.local HTTP/1.1" 404 606627 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:41 -0600] "GET /.env.production HTTP/1.1" 404 606627 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.29.157.66 mail.rolistore.com - [07/Sep/2026:00:55:42 -0600] "GET /.env.staging HTTP/1.1" 404 606627 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 05:54:25
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 01:54:18.305005 2026] [security2:error] [pid 3920:tid 3920] [client 34.29.157.66:51314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.rockographer.com"] [uri "/.git/config"] [unique_id "ap5Riu47ltLfc0acLTJQcQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 05:34:40
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 01:34:33.613650 2026] [security2:error] [pid 22754:tid 22754] [client 34.29.157.66:32832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.robysinc.com"] [uri "/.git/config"] [unique_id "ap5M6e0mcM2sGSRluJznWwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-09-07 05:33:21
(9 hours ago)
(modsecurity) srv103 ModSecurity 34.29.157.66 (US/United States/66.157.29.34.bc.googleusercontent.co ...
show more
(modsecurity) srv103 ModSecurity 34.29.157.66 (US/United States/66.157.29.34.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-09-07 04:04:41
(11 hours ago)
[Sun Sep 06 22:04:39.157163 2026] [authz_core:error] [pid 89515:tid 139766288873024] [client 34.29.1 ...
show more
[Sun Sep 06 22:04:39.157163 2026] [authz_core:error] [pid 89515:tid 139766288873024] [client 34.29.157.66:39710] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Sun Sep 06 22:04:40.551562 2026] [authz_core:error] [pid 89515:tid 139766129477184] [client 34.29.157.66:39710] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Sun Sep 06 22:04:40.581874 2026] [authz_core:error] [pid 89515:tid 139765257061952] [client 34.29.157.66:39710] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-07 02:45:24
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 22:45:20.554783 2026] [security2:error] [pid 29576:tid 29576] [client 34.29.157.66:41740] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.rivercitieshtg.com"] [uri "/.git/config"] [unique_id "ap4lQIGPVRVBPDrdGS4BbAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-09-07 01:33:02
(13 hours ago)
Bad behaviour
Web Spam
Anonymous
2026-09-07 01:13:56
(14 hours ago)
Web scanner: GET /.git/config
Web App Attack
Hacking
🇪🇸
alferez
2026-09-07 00:33:06
(14 hours ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
Anonymous
2026-09-06 23:57:46
(15 hours ago)
[da.kdns.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.git/config | /.env | /.env ...
show more
[da.kdns.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.git/config | /.env | /.env.local
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 23:52:16
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.29.157.66 (66.157.29.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 19:52:10.528848 2026] [security2:error] [pid 20226:tid 20226] [client 34.29.157.66:46284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.rheemhvac.com"] [uri "/.git/config"] [unique_id "ap38qiyzrmO5L4GwFEoM0gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack