🇳🇱
Alt255
2026-09-11 12:43:58
UTC ·
(1 month ago)
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /src/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /htdocs/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - ...
show more
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /src/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /htdocs/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /wordpress/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /api/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /www/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /html/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.97.216.96 - - \[04/Sep/2026:18:11:35 +0200\] "GET /var/www/.git/config HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
123masterzeilen.nl:4
...
show less
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-06 00:22:10
UTC ·
(2 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 22:22:57
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:22:51.885287 2026] [security2:error] [pid 6980:tid 698 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:22:51.885287 2026] [security2:error] [pid 6980:tid 6980] [client 34.97.216.96:35492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.oligofoundry.com"] [uri "/.htaccess"] [unique_id "apyWO_itRhq0qABpj90vlgAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 22:03:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:03:31.037441 2026] [security2:error] [pid 30595:tid 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:03:31.037441 2026] [security2:error] [pid 30595:tid 30595] [client 34.97.216.96:43250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "impactqualityinc.com"] [uri "/html/.git/config"] [unique_id "apyRs4t7baGZesFs--BcLwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 21:31:12
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:31:07.526842 2026] [security2:error] [pid 13352:tid 13 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:31:07.526842 2026] [security2:error] [pid 13352:tid 13352] [client 34.97.216.96:47320] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "realdesigninterior.com"] [uri "/www/.git/config"] [unique_id "apyKG7BhKX3zA2s_-mDT5wAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-09-05 20:33:58
UTC ·
(2 months ago)
34.97.216.96 - - [05/Sep/2026:22:33:57 +0200] "GET /htdocs/.git/config HTTP/1.1" 404 435 "-" "crusader-worker/1.0" "share.fomx.gay"
...
Brute-Force
Web App Attack
🇺🇸
LSPCCU
2026-09-05 14:46:39
UTC ·
(2 months ago)
TSEC Honeypot Network report. Threat score: 69/100. Categories: Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: Attacker IP 34.97.216.96 observed using HTTP client fingerprint 'HTTP Client: crusader-worker/1.0' 12 times when ...
show more
TSEC Honeypot Network report. Threat score: 69/100. Categories: Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: Attacker IP 34.97.216.96 observed using HTTP client fingerprint 'HTTP Client: crusader-worker/1.0' 12 times when connecting to a energy sector honeypot between 2026-09-05 11:27 and 2026-09-05 11:27....
show less
Hacking
Brute-Force
Web App Attack
SSH
🇩🇪
barbarella
2026-09-05 11:33:06
UTC ·
(2 months ago)
Multiple (23) times attack on https port 443: Configuration snooping (GET /public/.git/config)
13:33:06 Configuration snooping (GET /app/.git/config)
13:33:06 Configuration snooping (GET /var/www/.git/config)
13:33:06 Configuration snoo ...
show more
Multiple (23) times attack on https port 443: Configuration snooping (GET /public/.git/config)
13:33:06 Configuration snooping (GET /app/.git/config)
13:33:06 Configuration snooping (GET /var/www/.git/config)
13:33:06 Configuration snooping (GET /html/.git/config)
13:33:06 Configuration snooping (GET /htdocs/.git/config)
13:33:06 Configuration snooping (GET /api/.git/config)
13:33:06 Configuration snooping (GET /backend/.git/config)
13:33:06 Configuration snooping (GET /site/.git/config)
13:33:06 Configuration snooping (GET /www/.git/config)
show less
Hacking
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-05 02:10:01
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-05 01:52:53
UTC ·
(2 months ago)
(mod_security) mod_security (id:949110) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 21:52:46.119914 2026] [security2:error] [pid 7212:tid 721 ...
show more
(mod_security) mod_security (id:949110) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 21:52:46.119914 2026] [security2:error] [pid 7212:tid 7212] [client 34.97.216.96:49648] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "justinpenney.com"] [uri "/backend/.git/config"] [unique_id "apt17l0yqxgVF6ATKU0KBAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-04 21:59:51
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-03.
Web App Attack
SSH
Hacking
🇫🇷
dynamix
2026-09-04 20:40:23
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 18:58:46
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 14:58:40.653749 2026] [security2:error] [pid 29637:tid 29 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.216.96 (96.216.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 14:58:40.653749 2026] [security2:error] [pid 29637:tid 29637] [client 34.97.216.96:33144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.silalaw.com"] [uri "/htdocs/.git/config"] [unique_id "apsU4JWEc_ZO-h-xFsqI5AAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-09-04 18:38:58
UTC ·
(2 months ago)
cloudlinux2 fail2ban: 2026-09-04 20:33:49,948 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 155.2.215.115 - 2026-09-04 20:33:49cloudlinux2 fail2ban: 2026-09-04 20:34:01,337 fail2ban.filter [1594]: INFO [plesk-wordpress] F ...
show more
cloudlinux2 fail2ban: 2026-09-04 20:33:49,948 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 155.2.215.115 - 2026-09-04 20:33:49cloudlinux2 fail2ban: 2026-09-04 20:34:01,337 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 193.56.116.54 - 2026-09-04 20:34:00cloudlinux2 fail2ban: 2026-09-04 20:34:02,264 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 193.56.116.56 - 2026-09-04 20:34:00cloudlinux2 fail2ban: 2026-09-04 20:35:54,444 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 34.97.216.96 - 2026-09-04 20:35:54cloudlinux2 fail2ban: 2026-09-04 20:35:54,428 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 34.97.216.96 - 2026-09-04 20:35:54cloudlinux2 fail2ban: 2026-09-04 20:35:54,406 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 34.97.216.96 - 2026-09-04 20:35:54cloudlinux2 fail2ban: 2026-09-04 20:35:54,436 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 34.97.216.96 - 2026-09-04 20:35:54cloud
show less
Web App Attack
🇳🇱
MyGlobalFlowers
2026-09-04 17:55:21
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack
