Anonymous
2026-10-28 10:35:23
(8 hours ago)
GET /.git/config HTTP/1.1
...
Web App Attack
π«π·
dynamix
2026-10-28 09:48:16
(8 hours ago)
Multiple WAF Violations
Web App Attack
π¨π
zynex
2026-10-28 09:47:12
(8 hours ago)
URL Probing: /backend/.env
Web App Attack
π³π±
Mangelot Hosting
2026-10-27 18:58:53
(23 hours ago)
(modsec_attack) srv102 ModSecurity attack 34.92.52.112 (HK/Hong Kong/112.52.92.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
Anonymous
2026-10-27 15:20:54
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
πΊπΈ
TPI-Abuse
2026-10-27 13:29:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.52.112 (112.52.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:29:51.428614 2026] [security2:error] [pid 5807:tid 580 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.52.112 (112.52.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:29:51.428614 2026] [security2:error] [pid 5807:tid 5807] [client 34.92.52.112:41312] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tradelosangeles.com"] [uri "/.git/config"] [unique_id "auCnT4-jQ7SwSu49Ju9u8AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-27 12:54:38
(1 day ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-27 09:42:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.92.52.112 (112.52.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 05:42:46.350092 2026] [security2:error] [pid 15741:tid 15 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.92.52.112 (112.52.92.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 05:42:46.350092 2026] [security2:error] [pid 15741:tid 15741] [client 34.92.52.112:54168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tractiondrive.com"] [uri "/.git/config"] [unique_id "auByFnhhFFM0LPVtwxootAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π¦πΉ
SchiWaGoA
2026-10-27 08:04:49
(1 day ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
π©πͺ
pltcldvlpr
2026-10-27 05:16:59
(1 day ago)
CMS/framework probe: 34.92.52.112 - - [27/Oct/2026:06:16:58 +0100] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" asn=396982 org="Google LLC" country=HK
.. ...
show more
CMS/framework probe: 34.92.52.112 - - [27/Oct/2026:06:16:58 +0100] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" asn=396982 org="Google LLC" country=HK
...
show less
Web App Attack
π¬π§
bensmithurst
2026-10-27 00:08:53
(1 day ago)
34.92.52.112 - - [27/Oct/2026:00:08:52 +0000] "GET /.git/config HTTP/1.1" 302 138 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.92.52.112 - - [27/Oct/2026:00:08:52 +0000] "GET /.env HTT ...
show more
34.92.52.112 - - [27/Oct/2026:00:08:52 +0000] "GET /.git/config HTTP/1.1" 302 138 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.92.52.112 - - [27/Oct/2026:00:08:52 +0000] "GET /.env HTTP/1.1" 302 138 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
... [host=LAN***]
show less
Bad Web Bot
Web App Attack
π©πͺ
AetherFox
2026-10-26 23:34:36
(1 day ago)
AetherFox VoidGuard detected: [Tue Oct 27 00:34:36.285003 2026] [authz_core:error] [pid 3998:tid 4006] [client 34.92.52.112:35116] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Tue Oct 27 00:34:36.287127 2026] [authz_core:e ...
show more
AetherFox VoidGuard detected: [Tue Oct 27 00:34:36.285003 2026] [authz_core:error] [pid 3998:tid 4006] [client 34.92.52.112:35116] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Tue Oct 27 00:34:36.287127 2026] [authz_core:error] [pid 3998:tid 4006] [client 34.92.52.112:35116] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html
[Tue Oct 27 00:34:36.505755 2026] [authz_core:error] [pid 3998:tid 4009] [client 34.92.52.112:35116] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Tue Oct 27 00:34:36.505946 2026] [authz_core:error] [pid 3998:tid 4009] [client 34.92.52.112:35116] AH01630: client denied by server configuration: /var/www/ERRORpages/403.html
[Tue Oct 27 00:34:36.703441 2026] [authz_core:error] [pid 3998:tid 4022] [client 34.92.52.112:35116] AH01630: client denied by server configuration: proxy:https://[MASKED]/
...
show less
Bad Web Bot
Web App Attack
π³π±
Site.eu
2026-10-26 22:04:27
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
π©πͺ
mbch
2026-10-26 17:58:47
(2 days ago)
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-26T17:58:47.560000+00:00 to 2026-10-26T17:58:49.523000+00:00: 10 distinct paths in 1.963s, denied HTTP 404. Trusted client-IP processing; forw ...
show more
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-26T17:58:47.560000+00:00 to 2026-10-26T17:58:49.523000+00:00: 10 distinct paths in 1.963s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.bak, /.env.backup, /.env.save, /.env.old.
show less
Web App Attack
π«π·
Quarks Solutions
2026-10-26 17:14:01
(2 days ago)
crowdsecurity/appsec-vpatch
Web App Attack