🇳🇱
middelkoopcc
2026-11-13 20:08:00
UTC ·
(1 hour ago)
2026-11-13 21:06:01 GET /.git/config [301] && 2026-11-13 21:06:01 GET /.env [301] && 2026-11-13 21:06:03 GET /.env.bak [301] && 239 more within 20 minutes
Web App Attack
🇺🇸
Nodez3r0
2026-11-13 19:49:16
UTC ·
(1 hour ago)
WOPR honeypot nedry.wopr.systems: 74 path_probe, 1 git_svn_probe, 1 admin_probe (e.g. /.git/config, /.env, /.env.local); first seen 2026-11-13T19:47:43Z, last seen 2026-11-13T19:49:16Z
Web App Attack
Hacking
Anonymous
2026-11-13 19:08:58
UTC ·
(2 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇳🇱
thedreamer.nl
2026-11-13 18:59:01
UTC ·
(2 hours ago)
34.92.195.102 - - [13/Nov/2026:19:55:48 +0100] "GET / HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "HK" "Hong Kong" "22.28420" "114.17590"
34.92.195.102 - - [1 ...
show more
34.92.195.102 - - [13/Nov/2026:19:55:48 +0100] "GET / HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "HK" "Hong Kong" "22.28420" "114.17590"
34.92.195.102 - - [13/Nov/2026:19:55:48 +0100] "POST / HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "HK" "Hong Kong" "22.28420" "114.17590"
34.92.195.102 - - [13/Nov/2026:19:55:48 +0100] "POST / HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "HK" "Hong Kong" "22.28420" "114.17590"
34.92.195.102 - - [13/Nov/2026:19:55:48 +0100] "POST / HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "HK" "Hong Kong" "22.28420" "114.17590"
34.92.195.102 - - [13/Nov/2026:19:55:49 +0100] "GET /.git/config HTTP/1.1" 40
...
show less
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-13 16:51:42
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:51:35.756993 2026] [security2:error] [pid 4703:tid 4 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 11:51:35.756993 2026] [security2:error] [pid 4703:tid 4703] [client 34.92.195.102:38482] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thediscounttoolbox.com"] [uri "/.git/config"] [unique_id "avdAFys7TCJmr2sOLGRS2AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 15:56:06
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:56:02.689282 2026] [security2:error] [pid 25778:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:56:02.689282 2026] [security2:error] [pid 25778:tid 25778] [client 34.92.195.102:54794] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedieselgroupllc.com.resilientigm.com"] [uri "/.git/config"] [unique_id "avczEi3XCdplr2iO7e9DyAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-13 15:39:41
UTC ·
(6 hours ago)
Scanning for web/db/file exploits on thedfcd.com
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 14:43:41
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:43:35.950424 2026] [security2:error] [pid 16260:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:43:35.950424 2026] [security2:error] [pid 16260:tid 16260] [client 34.92.195.102:47082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedental.globaldentalservices.com"] [uri "/.git/config"] [unique_id "avciFx20MVb16-6fiSeNvgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-13 13:00:01
UTC ·
(8 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇩🇪
shurizma
2026-11-13 12:50:31
UTC ·
(8 hours ago)
[13/Nov/2026:12:50:30 +0000] - 404 404 - GET https thedallasgang.com "/.git/config" [Client 34.92.195.102] [Length 188] [Gzip 3.14] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 ...
show more
[13/Nov/2026:12:50:30 +0000] - 404 404 - GET https thedallasgang.com "/.git/config" [Client 34.92.195.102] [Length 188] [Gzip 3.14] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
...
show less
Web App Attack
Bad Web Bot
🇩🇪
thesimonmanuel
2026-11-13 12:19:28
UTC ·
(9 hours ago)
34.92.195.102 - - [13/Nov/2026:17:49:27 +0530] "GET /.git/config HTTP/1.1" 403 177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
Web App Attack
🇮🇳
TFG-Server
2026-11-13 10:40:27
UTC ·
(11 hours ago)
Automated block: File theft attempt - tried to download secret/backup file x206 (e.g. /info.php.bak)
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-13 10:12:42
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:12:35.024122 2026] [security2:error] [pid 12426:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:12:35.024122 2026] [security2:error] [pid 12426:tid 12426] [client 34.92.195.102:54742] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thecrimsonpirate.com"] [uri "/.git/config"] [unique_id "avbik3Uld-ltCGkRh4eNdQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-13 09:27:39
UTC ·
(12 hours ago)
2.203 requests with url.path *.env
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-13 09:14:17
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:14:11.918148 2026] [security2:error] [pid 7939:tid 7 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.195.102 (102.195.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:14:11.918148 2026] [security2:error] [pid 7939:tid 7961] [client 34.92.195.102:59790] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thecraftsycat.theyogicat.com"] [uri "/.git/config"] [unique_id "avbU40Jo0DfdPo_WvLCiOQAAAIQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack