🇫🇮
diego021
2026-09-21 00:03:12
(3 hours ago)
34.6.227.47 pythonpirate.tech - [20/Sep/2026:19:03:10 -0500] "GET /.git/config HTTP/1.1" 404 158 "-" ...
show more
34.6.227.47 pythonpirate.tech - [20/Sep/2026:19:03:10 -0500] "GET /.git/config HTTP/1.1" 404 158 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 pythonpirate.tech - [20/Sep/2026:19:03:11 -0500] "GET /.env HTTP/1.1" 404 158 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 pythonpirate.tech - [20/Sep/2026:19:03:11 -0500] "GET /.env.local HTTP/1.1" 404 158 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 pythonpirate.tech - [20/Sep/2026:19:03:11 -0500] "GET /.env.production HTTP/1.1" 404 158 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
4server
2026-09-20 23:16:00
(4 hours ago)
[MonSep2101:15:59.4997732026][security2:error][pid2690339:tid2690474][client34.6.227.47:0]ModSecurit ...
show more
[MonSep2101:15:59.4997732026][security2:error][pid2690339:tid2690474][client34.6.227.47:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"pytag.ch\"][uri\"/\"][unique_id\"arBpL01rRvzI0McN9AOJ1wAAARc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇰
Leif Neland
2026-09-20 23:00:02
(4 hours ago)
Detected by CrowdSec on slim
Brute-Force
🇺🇸
TPI-Abuse
2026-09-20 22:26:00
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.6.227.47 (47.227.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.6.227.47 (47.227.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 18:25:53.530921 2026] [security2:error] [pid 14205:tid 14270] [client 34.6.227.47:52270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pyro-one.com"] [uri "/.git/config"] [unique_id "arBdccrOIQOG4IaldDQGwgAAAYY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-20 22:12:43
(5 hours ago)
Multiple WAF Violations
Web App Attack
2026-09-20 21:59:29
(5 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-20 21:55:40
(5 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.git/config | 2026-09-20 21:55 UTC
show less
Hacking
Web App Attack
2026-09-20 21:46:05
(5 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.6.227.47 (47.227.6.34.bc.googleuserc ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.6.227.47 (47.227.6.34.bc.googleusercontent.com)
show less
SQL Injection
2026-09-20 18:50:17
(8 hours ago)
IP matched detection query many 3xx errors.
Brute-Force
🇵🇱
sigurg
2026-09-20 17:29:29
(10 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇦🇺
Klaverstyn
2026-09-20 15:23:45
(12 hours ago)
Excessive HTTP request rate
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 14:39:36
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.6.227.47 (47.227.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.6.227.47 (47.227.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:39:31.433932 2026] [security2:error] [pid 6977:tid 7000] [client 34.6.227.47:36690] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pwihatah.com"] [uri "/.git/config"] [unique_id "aq_wI4_oISGLDgzVDGlgewAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 14:22:17
(13 hours ago)
2026/09/20 14:22:15 [error] 4753#4753: *153080 [client 34.6.227.47] ModSecurity: Access denied with ...
show more
2026/09/20 14:22:15 [error] 4753#4753: *153080 [client 34.6.227.47] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `55' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 55)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.29.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "pweegh.com"] [uri "/"] [unique_id "178991413582.850824"] [ref ""], client: 34.6.227.47, server: web.pweegh.com, request: "POST / HTTP/1.1", host: "pweegh.com"
2026/09/20 14:22:15 [error] 4753#4753: *153080 [client 34.6.227.47] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `55' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKIN
...
show less
Brute-Force
2026-09-20 13:39:06
(13 hours ago)
34.6.227.47 - - [20/Sep/2026:15:39:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; ...
show more
34.6.227.47 - - [20/Sep/2026:15:39:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 - - [20/Sep/2026:15:39:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 - - [20/Sep/2026:15:39:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 - - [20/Sep/2026:15:39:03 +0200] "GET /.git/config HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47 - - [20/Sep/2026:15:39:04 +0200] "GET /.env HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.6.227.47
...
show less
Bad Web Bot
Web App Attack
🇮🇹
Inartis
2026-09-20 13:20:11
(14 hours ago)
34.6.227.47 - - [20/Sep/2026:15:20:09 +0200] "GET /.git/config HTTP/1.1" 404 418 "-" "Mozilla/5.0 (X ...
show more
34.6.227.47 - - [20/Sep/2026:15:20:09 +0200] "GET /.git/config HTTP/1.1" 404 418 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack