🇳🇱
Alt255
2026-11-14 12:23:02
UTC ·
(2 hours ago)
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.97.17.81 - - [14/Nov/2026:13:22:46 +0100] "GET /.git/config HTTP/1.1" 404 2110 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7 ...
show more
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.97.17.81 - - [14/Nov/2026:13:22:46 +0100] "GET /.git/config HTTP/1.1" 404 2110 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.97.17.81 - - [14/Nov/2026:13:22:47 +0100] "GET /.env HTTP/1.1" 404 2110 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.97.17.81 - - [14/Nov/2026:13:22:47 +0100] "GET /.env.local HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.97.17.81 - - [14/Nov/2026:13:22:47 +0100] "GET /.env.production HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X
...
show less
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-11-14 10:46:29
UTC ·
(3 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-14 10:36:54
UTC ·
(3 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Alt255
2026-11-14 10:27:21
UTC ·
(3 hours ago)
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.97.17.81 - - [14/Nov/2026:11:27:12 +0100] "GET /.git/config HTTP/1.1" 301 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, ...
show more
[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.97.17.81 - - [14/Nov/2026:11:27:12 +0100] "GET /.git/config HTTP/1.1" 301 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇦🇹
SchiWaGoA
2026-11-14 10:06:32
UTC ·
(4 hours ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-13 07:26:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:26:14.279992 2026] [security2:error] [pid 10014:tid 1001 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:26:14.279992 2026] [security2:error] [pid 10014:tid 10014] [client 34.97.17.81:49184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weathercarib.com"] [uri "/.git/config"] [unique_id "ava7lknT87MFnPe-r6ZtGwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 07:10:43
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:10:40.384139 2026] [security2:error] [pid 8951:tid 8951] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:10:40.384139 2026] [security2:error] [pid 8951:tid 8951] [client 34.97.17.81:46352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weather.stricklinranch.com"] [uri "/.git/config"] [unique_id "ava38No4zfuDgNRDmKbJjwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RamSet
2026-11-13 07:08:52
UTC ·
(1 day ago)
[wx] HTTP-Probe on port 443 (via domain). 272 distinct paths probed in 47s. Sustained 277 req/min, 271 nonexistent paths (404). Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.remote, /.e ...
show more
[wx] HTTP-Probe on port 443 (via domain). 272 distinct paths probed in 47s. Sustained 277 req/min, 271 nonexistent paths (404). Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.remote, /.env.bak, /.env.backup, /.env.save, /.env.old, /.env.sample, /.env.example, /.env.dev, /.env.prod, /.env.stage, /.env.ci, /.env.docker, /.env.live, /.env.preprod, /.env.uat, /.env.dist, /.env.swp, /.env.txt, /.env.json, /.env.yaml, /.env.yml, /app/.env, /apps/.env, /api/.env, /web/.env, /site/.env, /public/.env, /admin/.env, /backend/.env, /server/.env, /frontend/.env, /src/.env, /core/.env, /core/app/.env, /config/.env, /private/.env, /application/.env, /bootstrap/.env, /database/.env, /storage/.env, /var/www/.env, /var/www/html/.env, /current/.env, /release/.env, /releases/.env, /shared/.env, /deploy/.env, /build/.env, /dist/.env, /public_html/.env, /htdocs/.env, /www/.env, /html/.env
show less
Bad Web Bot
Web App Attack
🇫🇮
olen.net
2026-11-13 07:03:35
UTC ·
(1 day ago)
Fail2Ban - lupus: Web exploit probing (WordPress, .env, .git, CGI, ...)
Web App Attack
🇬🇧
Comberton
2026-11-13 06:54:02
UTC ·
(1 day ago)
Ban via F2B web files probes
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 06:07:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:07:15.369861 2026] [security2:error] [pid 16727:tid 1672 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.17.81 (81.17.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:07:15.369861 2026] [security2:error] [pid 16727:tid 16727] [client 34.97.17.81:54288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wearywillie.com"] [uri "/.git/config"] [unique_id "avapE35UE53uYcoNYBDmaQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-13 05:23:32
UTC ·
(1 day ago)
5.043 requests with url.path *.env
856 requests with url.path *phpinfo.php
117 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇫🇷
pm33
2026-11-13 00:31:24
UTC ·
(1 day ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇦🇺
screwlooseit.com.au
2026-11-12 22:58:55
UTC ·
(1 day ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/81.17.97.34.bc.googleusercontent.com
Web App Attack
🇳🇬
lendsqr
2026-11-12 22:37:46
UTC ·
(1 day ago)
Automated attack on our web servers: asked for 240 secret-file paths. Blocked.
Bad Web Bot
Web App Attack
