🇳🇱
Alt255
2026-09-14 10:34:53
(1 week ago)
[ti-14al] Excessive 404 errors (web scanning): 56 suspicious requests detected by fail2ban jail <nam ...
show more
[ti-14al] Excessive 404 errors (web scanning): 56 suspicious requests detected by fail2ban jail <name>. Example: 34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.git/config HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env.save HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env.staging HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Ma
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-11 15:38:36
(2 weeks ago)
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.git/config HTTP/1.1" 404 646 "-" "Mozilla/5.0 ...
show more
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.git/config HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env.save HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env.staging HTTP/1.1" 404 646 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - - \[07/Sep/2026:06:07:45 +0200\] "GET /.env.dev HTTP/1.1" 404
...
show less
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-07 17:49:55
(2 weeks ago)
[MonSep0719:49:50.6442842026][security2:error][pid455537:tid455630][client34.32.127.1:0]ModSecurity: ...
show more
[MonSep0719:49:50.6442842026][security2:error][pid455537:tid455630][client34.32.127.1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varr=\(process.mainmodule\
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-07 03:54:35
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
Savvii
2026-09-07 03:30:55
(2 weeks ago)
20 attempts against mh_ha-misbehave-ban on grass
Brute-Force
Bad Web Bot
Web App Attack
2026-09-07 03:21:01
(2 weeks ago)
Scan for .env Files at 2026-09-07T03:21:01+00:00
Web App Attack
🇬🇧
gws-hostmaster
2026-09-07 03:17:10
(2 weeks ago)
ModSecurity OWASP CRS (Anomaly Score: 50): HTTP header is restricted by policy (/accept-charset/);Ja ...
show more
ModSecurity OWASP CRS (Anomaly Score: 50): HTTP header is restricted by policy (/accept-charset/);JavaScript Prototype Pollution;JSON-Based SQL Injection;Node.js Injection Attack 1/2;PHP Injection Attack: Variable Access Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Unix Shell Expression Found;Restricted File Access Attempt;SQL Injection Attack: SQL function name detected;URL file extension is restricted by policy;
show less
Web App Attack
2026-09-07 03:00:09
(2 weeks ago)
[server.dsamoodle.de] httpd-config-scan: sites=www.registration.dsamun.gr; logs=/var/log/httpd/domai ...
show more
[server.dsamoodle.de] httpd-config-scan: sites=www.registration.dsamun.gr; logs=/var/log/httpd/domains/registration.dsamun.gr.log; samples=/.git/config | /.env | /.env.local
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 02:43:56
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.32.127.1 (1.127.32.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.127.1 (1.127.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 22:43:48.195464 2026] [security2:error] [pid 5904:tid 5904] [client 34.32.127.1:46654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "register-yacht-bahamas.com"] [uri "/.git/config"] [unique_id "ap4k5Pt1_2CnEJ-DphH4_gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
javierin
2026-09-07 02:06:26
(2 weeks ago)
34.32.127.1 - regalo-personalizado.es - - [07/Sep/2026:02:06:25 +0000] "GET /@fs/etc/passwd HTTP/1.1 ...
show more
34.32.127.1 - regalo-personalizado.es - - [07/Sep/2026:02:06:25 +0000] "GET /@fs/etc/passwd HTTP/1.1" 404 3838 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.127.1 - regalo-personalizado.es - - [07/Sep/2026:02:06:25 +0000] "GET /@fs/etc/passwd?raw HTTP/1.1" 404 3838 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
Hacking
2026-09-07 01:44:52
(2 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-09-07 01:34:10
(2 weeks ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-07 01:32:48
(2 weeks ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇨🇦
lakered
2026-09-06 22:25:19
(2 weeks ago)
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Reconnaissance scan | Nginx Honeypot: Sensitive co ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Reconnaissance scan | Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d4312h1 - Ratio:0.97) | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:52492m)
show less
Hacking
Web App Attack
Port Scan
🇫🇷
dynamix
2026-09-06 22:07:13
(2 weeks ago)
Multiple WAF Violations
Web App Attack
