🇩🇪
Laplus
2026-11-14 05:33:42
UTC ·
(30 minutes ago)
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.git/config HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GE ...
show more
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.git/config HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.env HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.env.local HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.env.production HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.40.44.40 - - [14/Nov/2026:06:33:38 +0100] "GET /.env.staging HTTP/1.1" 404 51 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
...
show less
Hacking
Web App Attack
🇳🇱
Josh S.
2026-11-14 05:32:42
UTC ·
(31 minutes ago)
{"level":"info","ts":1794634361.6201591,"logger":"http.log.access.log2","msg":"handled request","request":{"remote_ip":"34.40.44.40","remote_port":"54484","client_ip":"34.40.44.40","proto":"HTTP/1.1","method":"GET","host":"notifications.joshseveros.c ...
show more
{"level":"info","ts":1794634361.6201591,"logger":"http.log.access.log2","msg":"handled request","request":{"remote_ip":"34.40.44.40","remote_port":"54484","client_ip":"34.40.44.40","proto":"HTTP/1.1","method":"GET","host":"notifications.joshseveros.cloud","uri":"/.git/config","headers":{"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["9b90153c"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"notifications.joshseveros.cloud"}},"bytes_read":0,"user_id":"","duration":0.000578013,"size":51,"status":404,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["application/json"],"Date":["Sat, 14 Nov 2026 05:32:41 GMT"],"Content-Length":["51"],"Access-Control-Allow-Origin":["*"]}}
{"level":"info","ts":1794634361.94
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 01:45:50
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.40.44.40 (40.44.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:45:46.728155 2026] [security2:error] [pid 20102:tid 2011 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.44.40 (40.44.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:45:46.728155 2026] [security2:error] [pid 20102:tid 20115] [client 34.40.44.40:46928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nothingwithoutwater.com"] [uri "/.git/config"] [unique_id "ave9SiQVxaj8ltpOdqcC0AAAAMs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-14 01:20:07
UTC ·
(4 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇫🇷
Danguole Rasalaite Memorial 🇱🇹
2026-11-14 01:11:37
UTC ·
(4 hours ago)
[SOC-ALERT: EXPLOIT-PROBE] Malicious crawler attempting arbitrary script execution on static web endpoints. Vector: Automated exploitation scan seeking vulnerable web applications (such as wp-login, xmlrpc, setup scripts, phpmyadmin) | MITRE ATT&CK: ...
show more
[SOC-ALERT: EXPLOIT-PROBE] Malicious crawler attempting arbitrary script execution on static web endpoints. Vector: Automated exploitation scan seeking vulnerable web applications (such as wp-login, xmlrpc, setup scripts, phpmyadmin) | MITRE ATT&CK: T1190 (Exploit Public-Facing Application). Enforcement: IP blocked across all ingress ports. Automated threat intelligence telemetry.
show less
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-11-14 01:03:08
UTC ·
(5 hours ago)
phpinfo probe on wellspr.ing/includes/phpinfo.php — WellSpr.ing/NetSentinel civic-AI security layer
Bad Web Bot
🇩🇪
yitzhaq
2026-11-14 01:02:20
UTC ·
(5 hours ago)
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.example HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] ...
show more
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.example HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.dev HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.prod HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.stage HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.40.44.40 - - [14/Nov/2026:02:02:17 +0100] "GET /.env.ci HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-14 00:51:43
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.40.44.40 (40.44.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 19:51:36.973978 2026] [security2:error] [pid 16761:tid 1676 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.44.40 (40.44.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 19:51:36.973978 2026] [security2:error] [pid 16761:tid 16761] [client 34.40.44.40:46848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "notforhirellc.com"] [uri "/.git/config"] [unique_id "avewmEp-Dn_hA9MxQ91wNgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-14 00:37:57
UTC ·
(5 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇨🇦
Not Fake
2026-11-14 00:37:05
UTC ·
(5 hours ago)
$f2bV_matches
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-13 23:01:02
UTC ·
(7 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
🇯🇵
HeliJP
2026-11-13 17:45:19
UTC ·
(12 hours ago)
2026-11-13T17:34:38Z - Recognized attacks\bad behavior from IP address 34.40.44.40 on port 443\80 (274 daily hits): client denied by server configuration
Port Scan
Hacking
SQL Injection
Brute-Force
Web App Attack
2026-11-13 16:45:24
UTC ·
(13 hours ago)
Vulnerability scan detected by WordPress firewall: 10 requests to non-existent paths within 2 minutes.
Web App Attack
🇩🇪
jbcrn
2026-11-13 01:06:36
UTC ·
(1 day ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-12 22:59:27
UTC ·
(1 day ago)
Auto-ban: >3000 req/min op 2026-11-12
Web App Attack
SSH
Hacking
