🇩🇪
4server
2026-10-23 02:42:16
(4 hours ago)
[FriOct2304:42:13.3236682026][security2:error][pid1995153:tid1995208][client34.95.36.85:0]ModSecurit ...
show more
[FriOct2304:42:13.3236682026][security2:error][pid1995153:tid1995208][client34.95.36.85:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"webdisk.mjgold.ch\"][uri\"/.env.bak\"][unique_id\"atrJhT2dJVKJWXYyOnC2yAAAANA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇦🇺
rubixstudios
2026-10-23 02:01:02
(4 hours ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 22:04:31
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 18:04:26.543219 2026] [security2:error] [pid 25592:tid 25592] [client 34.95.36.85:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.marshallcurry.com"] [uri "/.git/config"] [unique_id "atqIakhf7uQ_rKByFS0fTwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 20:39:27
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 16:39:21.623507 2026] [security2:error] [pid 19773:tid 19773] [client 34.95.36.85:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.mail-pmg.com"] [uri "/.git/config"] [unique_id "atp0eUN07K356N8UHuQ7NAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 18:33:50
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 14:33:47.007502 2026] [security2:error] [pid 17958:tid 17958] [client 34.95.36.85:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.luisgtechgroup.com"] [uri "/.git/config"] [unique_id "atpXC1Oeug6dw1bkYtPafQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 17:43:01
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.36.85 (85.36.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 13:42:56.051388 2026] [security2:error] [pid 841:tid 841] [client 34.95.36.85:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.goalsnet.net"] [uri "/.git/config"] [unique_id "atpLIJTOhcEVXAZOGNnxCwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-10-22 16:55:37
(13 hours ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇹🇷
Jova
2026-10-22 13:52:02
(17 hours ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇳🇱
Site.eu
2026-10-22 11:38:30
(19 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
LSPCCU
2026-10-22 07:56:19
(22 hours ago)
TSEC Honeypot Network report. Threat score: 72/100. Categories: Port Scan, Hacking, Brute-Force, Web ...
show more
TSEC Honeypot Network report. Threat score: 72/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: Attacker IP 34.95.36.85 observed using TLS client fingerprint 'Unknown TLS Client (e1db13f18329)' 2 times when connecting to a technology sector honeypot between 2026-10-22 05:16 and 2026-10-22 05:....
show less
Port Scan
Hacking
Brute-Force
Web App Attack
SSH
🇩🇪
Phenix Info
2026-10-22 05:54:30
(1 day ago)
SmallGuard.fr/Prestashop Massive 403
Web App Attack
🇳🇱
Alt255
2026-10-21 23:40:18
(1 day ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.95.36.85 - - [22/Oct/2026:01:40:17 +0200] "GET /.git/config HTTP/1.1" 301 602 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-21 19:11:04
(1 day ago)
34.95.36.85 - - [21/Oct/2026:19:10:58 +0000] "POST / HTTP/1.1" 403 26979 "-" "Mozilla/5.0 (X11; Linu ...
show more
34.95.36.85 - - [21/Oct/2026:19:10:58 +0000] "POST / HTTP/1.1" 403 26979 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.95.36.85"
34.95.36.85 - - [21/Oct/2026:19:10:58 +0000] "POST / HTTP/1.1" 403 26979 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.95.36.85"
34.95.36.85 - - [21/Oct/2026:19:10:59 +0000] "GET /.git/config HTTP/1.1" 403 20957 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.95.36.85"
34.95.36.85 - - [21/Oct/2026:19:11:00 +0000] "GET /.env HTTP/1.1" 403 20817 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.95.36.85"
34.95.36.85 - - [21/Oct/2026:19:11:00 +0000] "GET /.env.local HTTP/1.1" 403 20817 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.
...
show less
Web App Attack
🇿🇦
conure.sh
2026-10-21 15:37:47
(1 day ago)
csagent: score 20.7: 404 noise floor x3, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇧🇷
radardatelecom
2026-10-21 14:18:04
(1 day ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack