Anonymous
2026-09-17 13:18:54
(2 days ago)
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HT ...
show more
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot) Chrome/133.0.7177.2 Safari/537.36" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.development?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.production?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 126385 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Discordbot/2.0; +https://discordapp.com" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.loca
show less
Web App Attack
Port Scan
🇳🇱
Alt255
2026-09-11 12:42:25
(1 week ago)
34.87.173.136 - - \[08/Sep/2026:06:38:42 +0200\] "GET /@fs/../.env\?raw\?\? HTTP/1.1" 301 1119 "-" " ...
show more
34.87.173.136 - - \[08/Sep/2026:06:38:42 +0200\] "GET /@fs/../.env\?raw\?\? HTTP/1.1" 301 1119 "-" "Mozilla/5.0 \(compatible\; Perplexity-User/1.0\; +https://perplexity.ai/perplexity-user\)"
34.87.173.136 - - \[08/Sep/2026:06:38:42 +0200\] "GET /@fs/home/ec2-user/.aws/credentials\?raw\?\? HTTP/1.1" 301 1119 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/148.0.4455.32 Safari/537.36\; compatible\; GrokBot/1.0\; +https://x.ai/grokbot"
34.87.173.136 - - \[08/Sep/2026:06:38:42 +0200\] "GET /@fs/.env.local\?raw\?\? HTTP/1.1" 301 1119 "-" "Mozilla/5.0 \(compatible\; Claude-User/1.0\; +https://www.anthropic.com/claude-user\)"
34.87.173.136 - - \[08/Sep/2026:06:38:42 +0200\] "GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env\?raw\?\? HTTP/1.1" 301 1119 "-" "Mozilla/5.0 \(Windows NT 11.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\; compatible
...
show less
Bad Web Bot
Web App Attack
Anonymous
2026-09-10 14:01:06
(1 week ago)
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HT ...
show more
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot) Chrome/133.0.7177.2 Safari/537.36" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.development?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.production?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 126385 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Discordbot/2.0; +https://discordapp.com" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.loca
show less
Web App Attack
Port Scan
Anonymous
2026-09-09 04:27:01
(1 week ago)
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HT ...
show more
fail2ban jail apache-scanner: 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/.env?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot) Chrome/133.0.7177.2 Safari/537.36" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.development?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.production?raw?? HTTP/1.1" 404 123650 "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.87.173.136 - - [08/Sep/2026:04:14:32 -0700] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 126385 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Discordbot/2.0; +https://discordapp.com" 34.87.173.136 - - [08/Sep/2026:04:14:33 -0700] "GET /@fs/.env.loca
show less
Web App Attack
Port Scan
🇨🇿
Septimia
2026-09-09 02:00:34
(1 week ago)
Automatizovaný průzkum rozhraní FastCGI nebo pokus o zneužití webové aplikace. Zdroj je aktuálně blo ...
show more
Automatizovaný průzkum rozhraní FastCGI nebo pokus o zneužití webové aplikace. Zdroj je aktuálně blokován Fail2Banem. Služba/porty: http,https. Report vytvořen řízeně administrátorem OMEGA; bez raw logu a bez osobních údajů.
show less
Web App Attack
🇮🇳
evicky2002
2026-09-09 00:01:20
(1 week ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇭🇺
miszterx.hu
2026-09-08 18:58:52
(1 week ago)
XORP (haproxy): 300x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_i ...
show more
XORP (haproxy): 300x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu)
show less
Web App Attack
🇩🇪
hidemail.app
2026-09-08 12:52:12
(1 week ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ...
show more
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
show less
Web App Attack
Hacking
Anonymous
2026-09-08 11:14:33
(1 week ago)
fail2ban jail apache-secrets-probe: 34.87.173.136 - - [08/Sep/2026:04:14:31 -0700] "GET /@fs/..%252f ...
show more
fail2ban jail apache-secrets-probe: 34.87.173.136 - - [08/Sep/2026:04:14:31 -0700] "GET /@fs/..%252f..%252f..%252f..%252f..%252fapp/.env?raw?? HTTP/1.1" 404 126693 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 11:12:19
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.87.173.136 (136.173.87.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.87.173.136 (136.173.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 07:12:14.132205 2026] [security2:error] [pid 24213:tid 24213] [client 34.87.173.136:33188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.todotex.com"] [uri "/@fs/root/.env"] [unique_id "ap_tjh99V-axyQCrzDfNzAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-09-08 11:01:29
(1 week ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇫🇷
LRNP
2026-09-08 10:50:09
(1 week ago)
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/src/.env?raw?? HTTP/1.1" 404 118 "-" ...
show more
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/src/.env?raw?? HTTP/1.1" 404 118 "-" "Mozilla/5.0 (compatible; WhatsApp/10.0.2.1)"
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/.env?raw?? HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebot) Chrome/85.0.5718.93 Safari/537.36 Edg/85.0.5718.93"
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/root/.env?raw?? HTTP/1.1" 404 118 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user"
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/app/.env?raw?? HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.19) Gecko/20100101 Firefox/133.19; compatible; GrokBot/1.0; +https://x.ai/grokbot"
_:443 34.87.173.136 - - [08/Sep/2026:10:50:09 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 404
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-08 09:59:57
(1 week ago)
Excessive multi-domain requests
Brute-Force
Anonymous
2026-09-08 09:40:39
(1 week ago)
34.87.173.136 - - [08/Sep/2026:17:40:39 +0800] "GET /@fs/src/.env?raw?? HTTP/1.1" 404 196 "-" "Mozil ...
show more
34.87.173.136 - - [08/Sep/2026:17:40:39 +0800] "GET /@fs/src/.env?raw?? HTTP/1.1" 404 196 "-" "Mozilla/5.0 (compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php)"
34.87.173.136 - - [08/Sep/2026:17:40:39 +0800] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot) Chrome/109.0.1300.149 Mobile Safari/537.36"
34.87.173.136 - - [08/Sep/2026:17:40:39 +0800] "GET /@fs/app/.env?raw?? HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot) Chrome/124.0.4861.93 Safari/537.36"
34.87.173.136 - - [08/Sep/2026:17:40:39 +0800] "GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/1.1" 404 196 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)"
34
...
show less
Bad Web Bot
Web App Attack
🇫🇷
david.houstin
2026-09-08 09:11:30
(1 week ago)
34.87.173.136 - - [08/Sep/2026:11:10:55 +0200] "GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HT ...
show more
34.87.173.136 - - [08/Sep/2026:11:10:55 +0200] "GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HTTP/1.1" 404 1799 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot)"
34.87.173.136 - - [08/Sep/2026:11:10:56 +0200] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 404 5918 "https://www.chinesetools.eu/@fs/var/www/html/wp-config.php?raw??" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 21157 -
34.87.173.136 - - [08/Sep/2026:11:11:28 +0200] "GET /config.json HTTP/1.1" 404 5918 "https://www.chinesetools.eu/config.json" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 13507 -
34.87.173.136 - - [08/Sep/2026:11:11:28 +0200] "GET /api/config HTTP/1.1" 404 37504 "https://www.chinesetools.eu/api/config" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Web App Attack
Bad Web Bot