🇳🇱
Roderic
2026-11-03 17:24:58
UTC ·
(1 week ago)
Insights: web vulnerability probing, 98 requests on 1 site, e.g. /.env.staging.local, /.env.staging, /v2/.env (rotating 29 fake bot names, e.g. ChatGLM-Spider, Bravebot, Kimi-SearchBot)
Web App Attack
🇳🇱
BlueWire Hosting
2026-11-03 17:09:11
UTC ·
(1 week ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇬🇧
thetomtaylor.co.uk
2026-11-03 17:08:01
UTC ·
(1 week ago)
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice01,ice02,wa01,wa02]
Hacking
SQL Injection
Web App Attack
🇫🇮
oh.mg
2026-11-03 13:25:20
UTC ·
(1 week ago)
34.89.157.76 - - [03/Nov/2026:14:25:13 +0100] "GET /robots.txt HTTP/1.1" 403 499 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.89.157.76 - - [03/Nov/2026:14:25:17 +0100] "GET /l5tn4lk81xnf1avzomo6 HTT ...
show more
34.89.157.76 - - [03/Nov/2026:14:25:13 +0100] "GET /robots.txt HTTP/1.1" 403 499 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.89.157.76 - - [03/Nov/2026:14:25:17 +0100] "GET /l5tn4lk81xnf1avzomo6 HTTP/1.1" 403 2176 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
34.89.157.76 - - [03/Nov/2026:14:25:19 +0100] "GET /.env.test HTTP/1.1" 403 499 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.89.157.76 - - [03/Nov/2026:14:25:19 +0100] "GET /dev/.env HTTP/1.1" 403 499 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.89.157.76 - - [03/Nov/2026:14:25:19 +0100] "GET /ses.env HTTP/1.1" 403 499 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
zcampbell
2026-11-03 13:03:54
UTC ·
(1 week ago)
Web vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automatically.
Web App Attack
Bad Web Bot
🇺🇸
Starburst SysOp Team
2026-11-03 13:02:00
UTC ·
(1 week ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX: ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-srv1)
show less
Bad Web Bot
🇳🇱
Site.eu
2026-11-03 12:56:01
UTC ·
(1 week ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-03 12:35:48
UTC ·
(1 week ago)
[ti-17al] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.89.157.76 - - [03/Nov/2026:13:35:32 +0100] "GET /assets../.env HTTP/2.0" 301 589 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alib ...
show more
[ti-17al] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.89.157.76 - - [03/Nov/2026:13:35:32 +0100] "GET /assets../.env HTTP/2.0" 301 589 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
34.89.157.76 - - [03/Nov/2026:13:35:32 +0100] "GET /css../.env HTTP/2.0" 301 559 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
34.89.157.76 - - [03/Nov/2026:13:35:32 +0100] "GET /js../.env HTTP/2.0" 403 539 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
34.89.157.76 - - [03/Nov/2026:13:35:32 +0100] "GET /media../.env HTTP/2.0" 301 587 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.89.157.76 - -
...
show less
Bad Web Bot
Web App Attack
2026-11-03 12:13:28
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-11-03 11:20:02
UTC ·
(1 week ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇩🇪
Hary74656
2026-11-03 11:11:21
UTC ·
(1 week ago)
Fail2Ban on schani.hostmi.at: jail=apache-modsecurity, failures=3.
[earlier text truncated]
ore. [file "/opt/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ve ...
show more
Fail2Ban on schani.hostmi.at: jail=apache-modsecurity, failures=3.
[earlier text truncated]
ore. [file "/opt/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.30.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "weavernet.at"] [uri "/process.env"] [unique_id "aunBWFJJ0ELGxPBSQl6SeQAAlgg"]
[Tue Nov 03 12:11:21.120170 2026] [vhost aschi.at] [security2:error] [pid 368559:tid 139916354688704] [client 34.89.157.76:59520] [realclient 34.89.157.76:59520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 45)"] [ver "OWASP_CRS/4.30.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "weavernet.at"] [uri "/api/console/api_server"] [unique_id "aunBWVJJ0ELGxPBSQl6SlgAAigg"]
show less
Web App Attack
🇬🇧
Aetherweb Ark
2026-11-03 10:47:15
UTC ·
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 34.89.157.76 (DE/Germany/76.157.89.34.bc.googleusercontent.com): N in the last X secs
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 10:34:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.89.157.76 (76.157.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 05:34:15.562434 2026] [security2:error] [pid 13287:tid 13 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.89.157.76 (76.157.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 05:34:15.562434 2026] [security2:error] [pid 13287:tid 13287] [client 34.89.157.76:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.empoweruamerica.org"] [uri "/.env.dev.local"] [unique_id "aum4pxg6FKDziDH7srQHAQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-11-03 09:25:12
UTC ·
(1 week ago)
Accessed trap at '/.env'
Web App Attack
🇳🇱
Alboweb B.V.
2026-11-03 09:11:05
UTC ·
(1 week ago)
Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail
Bad Web Bot
