34.35.200.70

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Automated: Credential theft attempt - JSON bomb served

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-08.

[FriMay0810:37:37.9557312026][security2:error][pid1683737:tid1683807][client34.35.200.70:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|h ... show more [FriMay0810:37:37.9557312026][security2:error][pid1683737:tid1683807][client34.35.200.70:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"vivereintrentino.it\"][uri\"/app/.env\"][unique_id\"af2g0cQURFevXIe_LBrRugAAAIk\"] show less

IP banned by Fail2Ban in jail suss access.log ah-app-1 ...

(mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:32:40.330279 2026] [security2:error] [pid 12485:tid 12 ... show more (mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:32:40.330279 2026] [security2:error] [pid 12485:tid 12485] [client 34.35.200.70:56630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ironheadsofseo.com"] [uri "/.git/config"] [unique_id "af11eJg3uioYkDNrx5x0bgAAAAM"] show less

(mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:42:41.540177 2026] [security2:error] [pid 14128:tid 14 ... show more (mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:42:41.540177 2026] [security2:error] [pid 14128:tid 14128] [client 34.35.200.70:50166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perissosdigitalmarketing.com.kevinfranz.com"] [uri "/.git/config"] [unique_id "af1pwUNwNvwrisCHhZMGUAAAAA4"] show less

34.35.200.70 - - [08/May/2026:04:22:40 +0000] "GET /.git/config HTTP/1.1" 404 50824 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; MDA Pro/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1)" ...

(mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:22:32.488516 2026] [security2:error] [pid 11358:tid 11 ... show more (mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:22:32.488516 2026] [security2:error] [pid 11358:tid 11358] [client 34.35.200.70:43286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "incident.oxfordgliding.com"] [uri "/.git/config"] [unique_id "af1lCLGsSt7Y1u-SjICyrgAAAAU"] show less

(mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:54:23.465078 2026] [security2:error] [pid 3510:tid 351 ... show more (mod_security) mod_security (id:210492) triggered by 34.35.200.70 (70.200.35.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:54:23.465078 2026] [security2:error] [pid 3510:tid 3510] [client 34.35.200.70:33920] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jasbemarketing.com"] [uri "/.git/config"] [unique_id "af1ebxnYeECWvgM1YjNJ_AAAAAE"] show less

/.git/config

Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)