🇳🇱
DonAtari
2026-09-06 09:58:56
UTC ·
(2 months ago)
DShield firewall scan - TCP to port 8000
Brute-Force
SSH
2026-09-06 08:39:13
UTC ·
(2 months ago)
Sep 6 10:39:10 mail2 Nextcloud[6671]: {"reqId":"ap0mrgtarkz8cib40sstVgAAAIc","level":1,"time":"2026-09-06T08:39:10+00:00","remoteAddr":"34.95.140.155","user":"--","app":"core","method":"GET","url":"/htdocs/.git/config","scriptName":"/index.php","mes ...
show more
Sep 6 10:39:10 mail2 Nextcloud[6671]: {"reqId":"ap0mrgtarkz8cib40sstVgAAAIc","level":1,"time":"2026-09-06T08:39:10+00:00","remoteAddr":"34.95.140.155","user":"--","app":"core","method":"GET","url":"/htdocs/.git/config","scriptName":"/index.php","message":"Trusted domain error. \"34.95.140.155\" tried to access using \"cloud.akcurate.de\" as host.","userAgent":"crusader-worker/1.0","version":"32.0.9.2","data":{"app":"core"}}
Sep 6 10:39:10 mail2 Nextcloud[6677]: {"reqId":"ap0mroVX3cNIfplq6-54YQAAAAc","level":1,"time":"2026-09-06T08:39:10+00:00","remoteAddr":"34.95.140.155","user":"--","app":"core","method":"GET","url":"/public/.git/config","scriptName":"/public.php","message":"Trusted domain error. \"34.95.140.155\" tried to access using \"cloud.akcurate.de\" as host.","userAgent":"crusader-worker/1.0","version":"32.0.9.2","data":{"app":"core"}}
Sep 6 10:39:10 mail2 Nextcloud[5017]: {"reqId":"ap0mrgtarkz8cib40sstVQAAAIM","level":1,"time":"2026-09-06T08:39:10+00:00","remoteAddr":"34.9
...
show less
Brute-Force
Web App Attack
🇺🇸
zapteryx
2026-09-06 07:53:18
UTC ·
(2 months ago)
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /backend/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /wordpress/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 ...
show more
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /backend/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /wordpress/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /api/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /var/www/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
34.95.140.155 - - [06/Sep/2026:03:53:17 -0400] "GET /html/.git/config HTTP/1.1" 400 264 "-" "crusader-worker/1.0"
...
show less
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-09-06 00:43:15
UTC ·
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 22:08:51
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:08:43.411159 2026] [security2:error] [pid 30589:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:08:43.411159 2026] [security2:error] [pid 30589:tid 30589] [client 34.95.140.155:59938] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hr-base-camp.com.smartstylehair.com"] [uri "/.git/config"] [unique_id "apyS6yx808Aut1YevOSjSQAAAGI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-09-05 11:21:50
UTC ·
(2 months ago)
34.95.140.155 - - [05/Sep/2026:13:21:50 +0200] "GET /app/.git/config HTTP/1.1" 403 110 "-" "crusader-worker/1.0" "console.pingusmc.org"
...
Brute-Force
Web App Attack
🇧🇾
lns.bz
2026-09-05 07:07:17
UTC ·
(2 months ago)
.env scanning [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:40:44
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:40:37.023801 2026] [security2:error] [pid 3474:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:40:37.023801 2026] [security2:error] [pid 3474:tid 3474] [client 34.95.140.155:55154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scoutinsignia.com"] [uri "/.env.local"] [unique_id "aprYZbHASjdWSTOGJ8xcXAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:07:03
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:06:56.540187 2026] [security2:error] [pid 810511:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:06:56.540187 2026] [security2:error] [pid 810511:tid 810511] [client 34.95.140.155:50076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.memelearning.net"] [uri "/.env.dev"] [unique_id "aprQgJkBDoYaAKls-xSYigAAADk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-09-04 13:40:36
UTC ·
(2 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, source_backup, scanner_ua, ignition_debug, config_backup, actuator. Observed by 1 sensor(s); 43 hits.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:39:09
UTC ·
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:39:01.628541 2026] [security2:error] [pid 21617:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:39:01.628541 2026] [security2:error] [pid 21617:tid 21617] [client 34.95.140.155:50260] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||fourdogsandadrone.celtickyss.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fourdogsandadrone.celtickyss.com"] [uri "/storage/logs/laravel.log"] [unique_id "aprJ9fcUfUSmE4o6EGQkzAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xxkodedxx
2026-09-04 12:55:59
UTC ·
(2 months ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 1× edge-block in 10m window.
Origin: BR / AS396982 Google LLC
Active: 12:55:51 UTC
Volume: 4 HTTP req, 15 honeypot probe(s)
Bait taken: /.env.example, /wp-config.ph ...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 1× edge-block in 10m window.
Origin: BR / AS396982 Google LLC
Active: 12:55:51 UTC
Volume: 4 HTTP req, 15 honeypot probe(s)
Bait taken: /.env.example, /wp-config.php.swp, /.env, /.env.dev, /.env.backup
Status mix: 301×3 444×1
Vhost fishing: md.zvxlabs.com
UA: "crusader-worker/1.0"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
2026-09-04 10:50:06
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /.env.old HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /.env.prod HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:23:50
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:23:46.722252 2026] [security2:error] [pid 24745:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:23:46.722252 2026] [security2:error] [pid 24745:tid 24745] [client 34.95.140.155:44878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "orboftime.com"] [uri "/.env.dev"] [unique_id "apqcMocxEyYORYMF-JIfcwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:01:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:01:31.957965 2026] [security2:error] [pid 20294:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.140.155 (155.140.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:01:31.957965 2026] [security2:error] [pid 20294:tid 20294] [client 34.95.140.155:33806] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.amazingthailand.net"] [uri "/.env.old"] [unique_id "apqW-zwBP7eV880oSt3KbAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack