🇩🇪
klaus_ph
2026-09-26 16:57:07
UTC ·
(1 month ago)
2026-09-25 18:30:53,757 fail2ban.actions [594716]: NOTICE [ipblocklist] Ban 34.75.11.29
...
Bad Web Bot
2026-09-23 10:02:13
UTC ·
(1 month ago)
34.75.11.29 - - [22/Sep/2026:07:32:53 -0500] "GET /.env?raw HTTP/1.1" 301 258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.c ...
show more
34.75.11.29 - - [22/Sep/2026:07:32:53 -0500] "GET /.env?raw HTTP/1.1" 301 258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot" 172.68.71.57
34.75.11.29 - - [22/Sep/2026:07:32:53 -0500] "GET /.env.local?raw HTTP/1.1" 301 264 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 172.68.71.58
34.75.11.29 - - [22/Sep/2026:07:32:54 -0500] "GET /.env HTTP/1.1" 301 254 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 172.68.71.32
34.75.11.29 - - [22/Sep/2026:07:32:54 -0500] "GET /.env?import&url&inline HTTP/1.1" 301 280 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.68.71.31
34.75.11.29 - - [22/Sep/2026:07:32:54 -0500] "GET /.env?import&raw HTTP/1.1" 301 269 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)" 172.6
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wbsouza
2026-09-23 03:24:19
UTC ·
(1 month ago)
CrowdSec: crowdsecurity/appsec-vpatch — automated firewall drops on self-hosted IDS sensor
Hacking
🇺🇸
Rip
2026-09-23 03:23:32
UTC ·
(1 month ago)
Remote Command Execution - Unix Shell Expression Found in URI
Web App Attack
2026-09-23 02:55:06
UTC ·
(1 month ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇳🇱
Savvii
2026-09-23 02:41:53
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-09-23 00:48:56
UTC ·
(1 month ago)
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge= ...
show more
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
34.75.11.29 - - [23/Sep/2026:00:48:39 +0000] "-" 400 193 "-" "-" "-" edge="34.75.11.29"
...
show less
Web Spam
Web App Attack
🇮🇩
Burayot
2026-09-22 20:16:28
UTC ·
(1 month ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 34.75.11.29 (US/United States/29.11.75.34.bc.googleusercontent.com): 2 in the last 3600 secs
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:25:07
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:24:59.260977 2026] [security2:error] [pid 29639:tid 2963 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:24:59.260977 2026] [security2:error] [pid 29639:tid 29639] [client 34.75.11.29:36510] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abbysue.com"] [uri "/.env.example"] [unique_id "arK568_CJ7TLVsU1Xv5NVQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 16:46:12
UTC ·
(1 month ago)
Bot / seems abusive / Apache connections: 34
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-22 14:06:38
UTC ·
(1 month ago)
Too many Status 40X (30)
Scanning/Probing (25)
Request Overload (103)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:31:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:31:05.726511 2026] [security2:error] [pid 21612:tid 2161 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:31:05.726511 2026] [security2:error] [pid 21612:tid 21612] [client 34.75.11.29:42870] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||abuscalledfreedom.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "abuscalledfreedom.com"] [uri "/z9x8c7v6b5-debug-trigger-abuscalledfreedom.com"] [unique_id "arKDGdGhtuw-XyvfmaJplAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-09-22 13:29:40
UTC ·
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.75.11.29 (US/United States/29.11.75.34.bc.googleusercontent.com)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 13:13:57
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:13:41.500810 2026] [security2:error] [pid 29848:tid 2984 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:13:41.500810 2026] [security2:error] [pid 29848:tid 29848] [client 34.75.11.29:37832] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||acadianahero.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "acadianahero.com"] [uri "/z9x8c7v6b5-debug-trigger-acadianahero.com"] [unique_id "arJ_Bf2lGkddfgaB76CkhwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 12:33:38
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:33:29.349754 2026] [security2:error] [pid 11429:tid 1142 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.75.11.29 (29.11.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:33:29.349754 2026] [security2:error] [pid 11429:tid 11429] [client 34.75.11.29:38074] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||accomplishedmagazine.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "accomplishedmagazine.com"] [uri "/z9x8c7v6b5-debug-trigger-accomplishedmagazine.com"] [unique_id "arJ1mVgkW_dzKHR11sCTyQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
