Anonymous
2026-11-06 03:00:19
UTC ·
(6 days ago)
Auto-reported by Fail2Ban (NPM-Auth)
Web App Attack
Anonymous
2026-11-04 20:58:34
UTC ·
(1 week ago)
34.32.128.210 - - [04/Nov/2026:22:58:30 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:58:30 +0200] "POST ...
show more
34.32.128.210 - - [04/Nov/2026:22:58:30 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:58:30 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:58:31 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:58:31 +0200] "GET /.git/config HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:58:31 +0200] "GET /.env HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34
...
show less
Bad Web Bot
Web App Attack
Anonymous
2026-11-04 20:00:00
UTC ·
(1 week ago)
Recorded requests from 34.32.128.210: 269 on 2026-11-04 (UTC; seconds omitted).
250/269 requests matched detection indicators (including probes). Specific CVE, access and execution success are unconfirmed.
Logged HTTP responses: 403=269.
Indicators ( ...
show more
Recorded requests from 34.32.128.210: 269 on 2026-11-04 (UTC; seconds omitted).
250/269 requests matched detection indicators (including probes). Specific CVE, access and execution success are unconfirmed.
Logged HTTP responses: 403=269.
Indicators (counts may overlap; selected types): configuration/information-file probes=41; environment-file probes=205; backup/archive path references=11; credential/configuration-related paths=5; information/management endpoint probes=3; version-control data probes=2; mail/plugin configuration endpoint probes=1; WordPress-related paths=1.
Sample: GET /.git/config
Retained evidence (URI): /.git/config
show less
Web App Attack
Hacking
🇺🇸
francelink.fr
2026-11-04 17:29:25
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-04T17:27:43.000Z.
Web App Attack
Anonymous
2026-11-04 17:20:49
UTC ·
(1 week ago)
Auto-reported by Fail2Ban (NPM-Auth)
Web App Attack
🇬🇧
noise.agency
2026-11-04 15:34:43
UTC ·
(1 week ago)
34.32.128.210 (NL/The Netherlands/210.128.32.34.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇵🇱
strefapi_com
2026-11-04 15:05:56
UTC ·
(1 week ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇩🇪
Mr-Money
2026-11-04 14:24:57
UTC ·
(1 week ago)
scenario: crowdsecurity/http-sensitive-files - events: 5
Web App Attack
Hacking
🇳🇱
middelkoopcc
2026-11-04 14:14:01
UTC ·
(1 week ago)
2026-11-04 15:12:51 GET /.git/config [301] && 2026-11-04 15:12:52 GET /.env [301] && 2026-11-04 15:12:52 GET /.env.bak [301] && 99 more within 20 minutes
Web App Attack
🇬🇧
bensmithurst
2026-11-04 12:30:50
UTC ·
(1 week ago)
34.32.128.210 - - [04/Nov/2026:12:30:50 +0000] "GET /.git/config HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:12:30:50 +0000] "G ...
show more
34.32.128.210 - - [04/Nov/2026:12:30:50 +0000] "GET /.git/config HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:12:30:50 +0000] "GET /.env HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
... [host=LAN***]
show less
Bad Web Bot
Web App Attack
🇱🇺
SiteXL
2026-11-04 12:28:58
UTC ·
(1 week ago)
Automated Fail2Ban detection: malicious activity observed; source IP was banned.
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-11-04 11:11:25
UTC ·
(1 week ago)
34.32.128.210 - - [04/Nov/2026:22:11:23 +1100] "GET /.env HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:11:24 +1100] "GE ...
show more
34.32.128.210 - - [04/Nov/2026:22:11:23 +1100] "GET /.env HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:11:24 +1100] "GET /.env.local HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.128.210 - - [04/Nov/2026:22:11:24 +1100] "GET /.env.production HTTP/1.1" 404 996 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
🇧🇬
Ilcheff
2026-11-04 10:57:40
UTC ·
(1 week ago)
Web scan (probing for sensitive files, CrowdSec http-sensitive-files): requests from 210.128.32.34.bc.googleusercontent.com [NL, AS396982 Google LLC] to a web server.
Web App Attack
🇫🇷
Ehvox
2026-11-04 10:34:11
UTC ·
(1 week ago)
BunkerWeb WAF detection: 34.32.128.210 - GET /phpinfo.php.save HTTP/1.1,
Reason: modsecurity - {"matched_vars":[".save\/","\/phpinfo.php.save"],"matched_var_names":["TX:EXTENSION","REQUEST_FILENAME"],"ids":["920440","930130"],"msgs":["URL file exten ...
show more
BunkerWeb WAF detection: 34.32.128.210 - GET /phpinfo.php.save HTTP/1.1,
Reason: modsecurity - {"matched_vars":[".save\/","\/phpinfo.php.save"],"matched_var_names":["TX:EXTENSION","REQUEST_FILENAME"],"ids":["920440","930130"],"msgs":["URL file extension is restricted by policy","Restricted File Access Attempt"],"anomaly_score":["10"]}
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-11-04 06:19:36
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack