🇺🇸
TPI-Abuse
2026-10-28 08:58:32
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 04:58:25.475065 2026] [security2:error] [pid 12423:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 04:58:25.475065 2026] [security2:error] [pid 12423:tid 12423] [client 34.39.221.76:36104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mentalmolecule.org"] [uri "/.git/config"] [unique_id "auG5MX7VQ2r3_7k7O-ngvAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
paissangroup
2026-10-28 08:29:26
(10 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-28 05:55:47
(12 hours ago)
(modsec_attack) srv101 ModSecurity attack 34.39.221.76 (BR/Brazil/76.221.39.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇧🇪
cmbplf
2026-10-28 05:23:26
(13 hours ago)
1.136 requests with url.path *.env
197 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇫🇷
Octopuce
2026-10-28 04:30:46
(14 hours ago)
Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /web/.env ...
Web App Attack
🇳🇱
Site.eu
2026-10-28 04:23:48
(14 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-28 04:22:55
(14 hours ago)
Try to access /.git/config
Web App Attack
🇺🇸
ruusvuu
2026-10-28 00:06:18
(18 hours ago)
Automated abuse report: 15 attack/probe requests from Google LLC / BR.
Targeted paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging.
Sample log lines:
[demo.mirregistry] 34.39.221.76 - - [27/Oct/2026:17:06:17 -0700] "GET /.env.sa ...
show more
Automated abuse report: 15 attack/probe requests from Google LLC / BR.
Targeted paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging.
Sample log lines:
[demo.mirregistry] 34.39.221.76 - - [27/Oct/2026:17:06:17 -0700] "GET /.env.sample HTTP/1.1" 404 241 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safar…
[demo.mirregistry] 34.39.221.76 - - [27/Oct/2026:17:06:17 -0700] "GET /.env.example HTTP/1.1" 404 241 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safa…
[demo.mirregistry] 34.39.221.76 - - [27/Oct/2026:17:06:17 -0700] "GET /.env.dev HTTP/1.1" 404 241 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/5…
Detected by an automated web-server log monitor.
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-27 22:59:41
(19 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-26.
Web App Attack
SSH
Hacking
🇯🇵
miki-mini
2026-10-27 21:29:33
(21 hours ago)
Web scanner: probing for exposed secrets (.env, .git/config and similar paths). 3+ hits within 10 minutes. Log timezone: JST (UTC+9).
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 15:01:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 11:01:10.592332 2026] [security2:error] [pid 27625:tid 27 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 11:01:10.592332 2026] [security2:error] [pid 27625:tid 27625] [client 34.39.221.76:49410] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "members.oxfordgliding.com"] [uri "/.git/config"] [unique_id "auC8to3QQXGyxWGgIb0eHgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-10-27 14:44:38
(1 day ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇬🇧
poundawebsiteltd
2026-10-27 14:07:52
(1 day ago)
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 34.39.221.76 (BR/Brazil/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 34.39.221.76 (BR/Brazil/76.221.39.34.bc.google ...
show more
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 34.39.221.76 (BR/Brazil/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 34.39.221.76 (BR/Brazil/76.221.39.34.bc.googleusercontent.com): 20 in the last 3600 secs
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 10:59:40
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 06:59:36.354950 2026] [security2:error] [pid 12627:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.221.76 (76.221.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 06:59:36.354950 2026] [security2:error] [pid 12627:tid 12627] [client 34.39.221.76:40500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "members.15tobefit.com"] [uri "/.git/config"] [unique_id "auCEGE_pdZZBM3HnIt5-qAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-10-27 10:41:11
(1 day ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, source_backup, server_status, wp_admin. Observed by 1 sensor(s); 552 hits.
Brute-Force
Web App Attack
