🇺🇸
TPI-Abuse
2026-10-23 02:58:41
(13 minutes ago)
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:58:35.050393 2026] [security2:error] [pid 29965:tid 29965] [client 35.254.136.149:53746] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.derek-stites.com"] [uri "/.git/config"] [unique_id "atrNWzjxqp9Gl3aaGdPk2gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Dentax
2026-10-23 02:48:48
(23 minutes ago)
35.254.136.149 - - [23/Oct/2026:04:48:47 +0200] "GET /.git/config HTTP/1.1" 404 381 "-" "Mozilla/5.0 ...
show more
35.254.136.149 - - [23/Oct/2026:04:48:47 +0200] "GET /.git/config HTTP/1.1" 404 381 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
...
show less
Web App Attack
2026-10-23 02:46:23
(26 minutes ago)
Attempted search for exploits and vulnerabilities detected by fail2ban
...
Port Scan
Brute-Force
🇮🇹
Inartis
2026-10-23 02:45:53
(26 minutes ago)
35.254.136.149 - - [23/Oct/2026:04:45:53 +0200] "GET /.git/config HTTP/1.1" 404 5623 "-" "Mozilla/5. ...
show more
35.254.136.149 - - [23/Oct/2026:04:45:53 +0200] "GET /.git/config HTTP/1.1" 404 5623 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0"
...
show less
Port Scan
Brute-Force
🇩🇪
dave
2026-10-23 02:43:32
(29 minutes ago)
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity ...
show more
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity/vpatch-git-config,custom/traefik-sensitive-path-probe observed_by=1_hosts hit_count=5 first_seen=2026-10-23T02:43:30Z last_seen=2026-10-23T02:43:32Z
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 02:34:56
(37 minutes ago)
(mod_security) mod_security (id:210350) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210350) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:34:51.411257 2026] [security2:error] [pid 3724:tid 3746] [client 35.254.136.149:23230] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||realauthentic.coffee|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "realauthentic.coffee"] [uri "/.git/config"] [unique_id "atrHy1iNqZWO7VohomUy2gAAANM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-10-23 02:30:19
(42 minutes ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_expos ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack
🇺🇸
Charlesiv
2026-10-23 02:29:48
(42 minutes ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
Timestamp: 2026-10-23T01:47:02Z
Ray ID: a4ed124c6d1a89c5
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-23 02:17:50
(54 minutes ago)
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:17:42.654866 2026] [security2:error] [pid 16387:tid 16387] [client 35.254.136.149:59256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dshvisuals.com"] [uri "/.git/config"] [unique_id "atrDxreb1NDe2tpvVd1WwgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-23 02:15:22
(57 minutes ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
lid3rc
2026-10-23 02:14:19
(58 minutes ago)
Túl magas biztonsági kockázatú IP (Score: 100)
Web App Attack
🇺🇸
Major Hostility
2026-10-23 02:14:02
(58 minutes ago)
"GET /.git/config HTTP/1.1" 404
"GET /.git/config HTTP/1.1" 404
"GET /.git/config HTTP/1.1" 404
Web App Attack
🇺🇸
infra-monitor
2026-10-23 02:00:09
(1 hour ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan
🇫🇷
masterguru
2026-10-23 01:57:40
(1 hour ago)
Multiple/Conflicting Connection Header Data Found. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(? ...
show more
Multiple/Conflicting Connection Header Data Found. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. (920210-201)
show less
Hacking
🇺🇸
TPI-Abuse
2026-10-23 01:53:08
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.254.136.149 (149.136.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 21:53:04.735241 2026] [security2:error] [pid 15693:tid 15693] [client 35.254.136.149:32682] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cosplayculture.com"] [uri "/.git/config"] [unique_id "atq-APo4abbuT5YGpNUbJwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack