🇮🇳
evicky2002
2026-05-14 06:00:00
UTC ·
(5 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇫🇷
SpaceHost-Server
2026-05-08 22:31:16
UTC ·
(6 months ago)
Brute-Force
Web App Attack
🇪🇸
Gem
2026-05-08 22:25:30
UTC ·
(6 months ago)
Unauthorized web scan.
Web App Attack
🇺🇸
Charlesiv
2026-05-08 08:03:45
UTC ·
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
Timestamp: 2026-05-08T06:59:36Z
Ray ID: 9f8695264e4ec4ed
UA: Mozilla/5.0 (Linux; Android 6.0.1; MI ...
show more
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
Timestamp: 2026-05-08T06:59:36Z
Ray ID: 9f8695264e4ec4ed
UA: Mozilla/5.0 (Linux; Android 6.0.1; MI 5 Build/MXB48T; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/3072 MicroMessenger/7.0.3.1400(0x2700033C) Process/tools NetType/WIFI Language/zh_CN
show less
Bad Web Bot
Anonymous
2026-05-08 06:24:03
UTC ·
(6 months ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1
Hacking
Web App Attack
🇮🇹
Inartis
2026-05-08 06:13:36
UTC ·
(6 months ago)
34.80.17.35 - - [08/May/2026:08:13:35 +0200] "GET /.git/config HTTP/1.1" 302 7607 "-" "Opera/9.80 (Android; Opera Mini/43.3.2254/150.36; U; en) Presto/2.12.423 Version/12.16"
...
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
IVski.com
2026-05-08 05:56:31
UTC ·
(6 months ago)
IVski WAF | Sensitive file probe detected - looking for .env, .git, backups or credentials
Port Scan
Brute-Force
Web App Attack
Anonymous
2026-05-08 05:26:27
UTC ·
(6 months ago)
34.80.17.35 - - [08/May/2026:13:26:26 +0800] "GET /.git/config HTTP/1.1" 404 39515 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120427 Firefox/15.0a1"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 05:08:42
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:08:37.106132 2026] [security2:error] [pid 17812:tid 1781 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:08:37.106132 2026] [security2:error] [pid 17812:tid 17812] [client 34.80.17.35:54680] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iconconstructors.com"] [uri "/.git/config"] [unique_id "af1v1b8UI5qFPF5t1wDeVwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-05-08 05:08:15
UTC ·
(6 months ago)
git exposure on 802.today/.git/config — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 04:48:44
UTC ·
(6 months ago)
(mod_security) mod_security (id:949110) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:48:41.264754 2026] [security2:error] [pid 19442:tid 1944 ...
show more
(mod_security) mod_security (id:949110) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:48:41.264754 2026] [security2:error] [pid 19442:tid 19442] [client 34.80.17.35:57368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "motunaonaobookings.com"] [uri "/.git/config"] [unique_id "af1rKS2yMZrkK_pE6tFWOwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
strxmpp
2026-05-08 04:38:43
UTC ·
(6 months ago)
34.80.17.35 - - [08/May/2026:06:38:41 +0200] "GET /.git/config HTTP/1.1" 404 3668 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36"
...
Bad Web Bot
🇺🇸
octageeks.com
2026-05-08 04:07:42
UTC ·
(6 months ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 03:58:36
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:58:30.324593 2026] [security2:error] [pid 25588:tid 2558 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:58:30.324593 2026] [security2:error] [pid 25588:tid 25588] [client 34.80.17.35:41538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bikinipageone.com"] [uri "/.git/config"] [unique_id "af1fZkUzTPjcpXWioHXJbwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 03:34:37
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:34:33.833588 2026] [security2:error] [pid 11878:tid 1187 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.17.35 (35.17.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:34:33.833588 2026] [security2:error] [pid 11878:tid 11878] [client 34.80.17.35:39670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.delidalga.com"] [uri "/.git/config"] [unique_id "af1ZyejTyL2MXeAMWBT12gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack