🇬🇧
Mendip_Defender
2026-09-18 20:04:44
(3 minutes ago)
[18/Sep/2026:21:04:58.640440 +0100] aq2ZahMW1Uuh98Fit3VhYgAAAEo 34.70.202.166 46946 188.246.206.60 7 ...
show more
[18/Sep/2026:21:04:58.640440 +0100] aq2ZahMW1Uuh98Fit3VhYgAAAEo 34.70.202.166 46946 188.246.206.60 7081
[18/Sep/2026:21:04:59.526532 +0100] aq2Za-rExjEWWYs6DMcT-AAAAAg 34.70.202.166 47004 188.246.206.60 7081
...
show less
Brute-Force
🇬🇧
oja
2026-09-18 19:53:06
(15 minutes ago)
Aggressive web scanner
Web App Attack
🇩🇪
maxpower
2026-09-18 19:48:46
(19 minutes ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.70.202.166 (US/United States/166.202. ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.70.202.166 (US/United States/166.202.70.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.70.202.166 - - [18/Sep/2026:21:48:42 +0200] "GET /.aws/credentials HTTP/1.1" 200 12071 "-" "Mozilla/5.0 (iPad; CPU OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1" "-" host=mail.focusabruzzo.eu
show less
Port Scan
🇩🇪
Ano_Nym
2026-09-18 19:04:49
(1 hour ago)
CrowdSec IDS alert on VPS 217.154.115.19 (DE). Scenario: crowdsecurity/http-sensitive-files
Web App Attack
2026-09-18 18:56:05
(1 hour ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇬🇧
blik2108
2026-09-18 18:44:17
(1 hour ago)
34.70.202.166 - - [18/Sep/2026:18:44:13 +0000] "GET /.aws/credentials HTTP/1.1" 404 3431 "-" "Mozill ...
show more
34.70.202.166 - - [18/Sep/2026:18:44:13 +0000] "GET /.aws/credentials HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-"
34.70.202.166 - - [18/Sep/2026:18:44:13 +0000] "GET /.aws/credentials HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-"
34.70.202.166 - - [18/Sep/2026:18:44:13 +0000] "GET /.aws/config HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-"
34.70.202.166 - - [18/Sep/2026:18:44:14 +0000] "GET /.env HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-"
34.70.202.166 - - [18/Sep/2026:18:44:14 +0000] "GET /.env.local HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chro
...
show less
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-18 18:34:17
(1 hour ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇱🇺
conseilgouz
2026-09-18 18:22:43
(1 hour ago)
are-17 : Block hidden directories=>/.aws/credentials(/)
Hacking
🇫🇷
conseilgouz
2026-09-18 18:06:17
(2 hours ago)
joe-17 : Block hidden directories=>/.aws/credentials(/)
Hacking
2026-09-18 17:53:04
(2 hours ago)
PSCSERV WPSCAN 34.70.202.166
Bad Web Bot
Web App Attack
🇨🇭
Ribeye375
2026-09-18 17:34:57
(2 hours ago)
HIPS nginx-access-errors - Block tcp/http,https
Brute-Force
🇩🇪
MarkGGN
2026-09-18 16:41:37
(3 hours ago)
Web attack. 34.70.202.166 - - [18/Sep/2026:18:41:37 +0200] "GET /.env HTTP/1.1" 200 1183 "https://gc ...
show more
Web attack. 34.70.202.166 - - [18/Sep/2026:18:41:37 +0200] "GET /.env HTTP/1.1" 200 1183 "https://gctour.*/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
34.70.202.166 - - [18/Sep/2026:18:41:37 +0200] "GET /.env.local HTTP/1.1" 200 1183 "https://gctour.*/.env.local" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
show less
Web App Attack
🇩🇪
XICTRON
2026-09-18 16:35:06
(3 hours ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇫🇷
baphomet
2026-09-18 14:16:37
(5 hours ago)
Probed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.e ...
show more
Probed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.env/wp-login/xmlrpc/phpmyadmin/.git).
jail=nginx-canary proto=tcp port=80,443 failures>=2 class=web-app-probe
these paths are not real apps on this host; hit is hostile recon
when=2026-09-18T14:16:37Z sensor=fail2ban role=web-canary
src=34.70.202.166
show less
Web App Attack
🇺🇸
leasj
2026-09-18 13:59:10
(6 hours ago)
Observed Scanned 7 known-sensitive endpoint(s), e.g.: /.aws/credentials, /.aws/config, /.env, /.env. ...
show more
Observed Scanned 7 known-sensitive endpoint(s), e.g.: /.aws/credentials, /.aws/config, /.env, /.env.local, /.env.production.
show less
Hacking
Bad Web Bot
Web App Attack