34.6.81.93

(mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 00:35:03.622609 2026] [security2:error] [pid 17643:tid 17643] ... show more (mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 00:35:03.622609 2026] [security2:error] [pid 17643:tid 17643] [client 34.6.81.93:42932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thesweeneys.ws"] [uri "/.git/config"] [unique_id "aqocd4OR52p7D_2qtqAnZQAAAAU"] show less

Attempts against non-existent wp-login

34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /project/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /node/.env H ... show more 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /project/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /node/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /express/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /next/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /nuxt/.env HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.6.81.93 - - [16/Sep/2026:01:56:34 +0200] "GET /nest/.env HTTP show less

Excessive 403/404 errors ...

(mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 15:11:03.919729 2026] [security2:error] [pid 10124:tid 10124] ... show more (mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 15:11:03.919729 2026] [security2:error] [pid 10124:tid 10124] [client 34.6.81.93:56346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rebelhollowfarm.com"] [uri "/.git/config"] [unique_id "aqmYR0D5oE8eFJWBy_A12gAAAAU"] show less

Web attack/malicious scanning detected

Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /webroot/index.php/_environment UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 S ... show more Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /webroot/index.php/_environment UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

(mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 10:02:55.787233 2026] [security2:error] [pid 21192:tid 21192] ... show more (mod_security) mod_security (id:210492) triggered by 34.6.81.93 (93.81.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 10:02:55.787233 2026] [security2:error] [pid 21192:tid 21192] [client 34.6.81.93:40292] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rebeccapratt.com"] [uri "/.git/config"] [unique_id "aqlQD7TLx5v8rnP9W20pDwAAABA"] show less

http-sensitive-files - IP: 34.6.81.93 - time="2026-09-15T16:02:44+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 34.6.81.93 (NL/396982) : 4h ban on Ip 34.6.81.93" module=db

[web.zebs.ch] httpd-config-scan: sites=www.swisscybertech.ch; logs=/var/log/httpd/access_log,/var/log/httpd/domains/swisscybertech.ch.log; samples=/.git/config | /.env | /.env.local

Automatisch erkannt: Zugriff auf /.git/config (swiss-jobrollen-check.ch)

WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail

IP matched detection query bad paths many.

Blocked by ConnMonitor

categories: Email Spam