🇹🇷
ayayntr
2026-11-09 07:55:35
UTC ·
(16 minutes ago)
[Mon Nov 09 10:55:30.190819 2026] [proxy_fcgi:error] [pid 1478:tid 1630] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
[Mon Nov 09 10:55:30.444157 2026] [proxy_fcgi:error] [pid 1478:tid 1631] [client 34.95.198.69:34430] AH01 ...
show more
[Mon Nov 09 10:55:30.190819 2026] [proxy_fcgi:error] [pid 1478:tid 1630] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
[Mon Nov 09 10:55:30.444157 2026] [proxy_fcgi:error] [pid 1478:tid 1631] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
[Mon Nov 09 10:55:30.689767 2026] [proxy_fcgi:error] [pid 1478:tid 1622] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
[Mon Nov 09 10:55:30.942176 2026] [proxy_fcgi:error] [pid 1478:tid 1595] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
[Mon Nov 09 10:55:31.206112 2026] [proxy_fcgi:error] [pid 1478:tid 1599] [client 34.95.198.69:34430] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
SSH
🇧🇪
cmbplf
2026-11-09 05:22:25
UTC ·
(2 hours ago)
1.549 requests with url.path *.env
223 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇫🇮
oh.mg
2026-11-09 03:55:59
UTC ·
(4 hours ago)
[Mon Nov 09 04:55:59.488763 2026] [security2:error] [pid 3849278:tid 3849293] [client 34.95.198.69:33932] [client 34.95.198.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/us ...
show more
[Mon Nov 09 04:55:59.488763 2026] [security2:error] [pid 3849278:tid 3849293] [client 34.95.198.69:33932] [client 34.95.198.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "vms.mrman.net"] [uri "/"] [unique_id "avFET2qCltumLbGQ_45emAAAAY0"]
...
show less
Web App Attack
Bad Web Bot
Anonymous
2026-11-09 02:58:28
UTC ·
(5 hours ago)
34.95.198.69 detected on srv01
Brute-Force
🇩🇪
TheDjRider
2026-11-09 02:10:26
UTC ·
(6 hours ago)
CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban triggered. Detection time (UTC): 2026-11-09T02:10:23.250131778Z. Context: http_status=404
Web App Attack
🇭🇷
IgorS.zg.hr
2026-11-08 23:51:15
UTC ·
(8 hours ago)
Web application attack detected by fail2ban
Hacking
Web App Attack
🇬🇧
blik2108
2026-11-08 21:03:40
UTC ·
(11 hours ago)
34.95.198.69 - - [08/Nov/2026:21:03:34 +0000] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026:21:03:35 +0000] "GET /.env ...
show more
34.95.198.69 - - [08/Nov/2026:21:03:34 +0000] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026:21:03:35 +0000] "GET /.env HTTP/1.1" 404 1267 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026:21:03:36 +0000] "GET /.env.local HTTP/1.1" 404 1165 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026:21:03:36 +0000] "GET /.env.production HTTP/1.1" 404 1165 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026:21:03:36 +0000] "GET /.env.staging HTTP/1.1" 404 1165 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
34.95.198.69 - - [08/Nov/2026
...
show less
Web App Attack
🇫🇮
oh.mg
2026-11-08 20:49:26
UTC ·
(11 hours ago)
[Sun Nov 08 21:49:26.239285 2026] [security2:error] [pid 3742129:tid 3742140] [client 34.95.198.69:0] [client 34.95.198.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/sh ...
show more
[Sun Nov 08 21:49:26.239285 2026] [security2:error] [pid 3742129:tid 3742140] [client 34.95.198.69:0] [client 34.95.198.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "vm109.sup.coop"] [uri "/.env.txt"] [unique_id "avDgVppdqZINOUW8xze1xAAAAMk"]
[Sun Nov 08 21:49:26.703559 2026] [security2:error] [pid 3738914:tid 3738932] [client 34.95.198.69:0] [client 34.95.198.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly
...
show less
Web App Attack
Bad Web Bot
Anonymous
2026-11-08 19:30:03
UTC ·
(12 hours ago)
CrowdSec decision: crowdsecurity/http-probing (origin: crowdsec)
Web App Attack
🇩🇪
FeG Deutschland
2026-11-08 17:50:17
UTC ·
(14 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇧🇷
radardatelecom
2026-11-08 16:55:02
UTC ·
(15 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-11-08 16:22:05
UTC ·
(15 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-11-08 16:16:01
UTC ·
(15 hours ago)
2026-11-08 17:14:11 GET /.git/config [404] && 2026-11-08 17:14:12 GET /.env [404] && 2026-11-08 17:14:17 GET /.env.bak [404] && 99 more within 20 minutes
Web App Attack
🇳🇱
debestelapp
2026-11-08 16:15:11
UTC ·
(15 hours ago)
Web App Attack
🇮🇹
VHosting
2026-11-08 09:15:05
UTC ·
(22 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack