🇭🇺
DumaNet
2026-06-09 06:21:00
(4 days ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 Jun 08. 09:59:28
Source IP: 94.176 ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 Jun 08. 09:59:28
Source IP: 94.176.161.167
Portion of the log(s):
94.176.161.167 - [08/Jun/2026:09:59:27 +0200] "GET /.env.production HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
94.176.161.167 - [08/Jun/2026:09:59:26 +0200] "GET /.env.local HTTP/1.1" 404 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot"
94.176.161.167 - [08/Jun/2026:09:59:25 +0200] "GET /.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] )"
94.176.161.167 - [08/Jun/2026:09:59:19 +0200] "GET /.env.example HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
94.176.161.167 - [08/Jun/2026:09:59:17 +0200] "GET /config/application.properties HTTP/1.1" 404 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0
show less
Web App Attack
Hacking
2026-06-08 07:42:37
(5 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
2026-06-08 07:42:07
(5 days ago)
Bot / scanning and/or hacking attempts: [18/18] read: stream 0, , GET /.env.development HTTP/2.0
Hacking
Web App Attack
🇨🇭
4server
2026-06-08 07:32:13
(5 days ago)
[MonJun0809:32:09.8000502026][security2:error][pid3135371:tid3135587][client94.176.161.167:0]ModSecu ...
show more
[MonJun0809:32:09.8000502026][security2:error][pid3135371:tid3135587][client94.176.161.167:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"rssolution.rs-solution.ch\"][uri\"/.git/config\"][unique_id\"aiZv-aTNgOWKdzn6bdI7zwAAAME\"]
show less
Hacking
Web App Attack
🇨🇦
electronico
2026-06-08 07:17:22
(5 days ago)
94.176.161.167 - - [08/Jun/2026:18:17:00 +1100] "GET /application.yml HTTP/1.1" 404 4024 "http://rsp ...
show more
94.176.161.167 - - [08/Jun/2026:18:17:00 +1100] "GET /application.yml HTTP/1.1" 404 4024 "http://rspamd.host/application.yml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot"
94.176.161.167 - - [08/Jun/2026:18:17:01 +1100] "GET /debug/pprof/cmdline HTTP/1.1" 404 4024 "http://rspamd.host/debug/pprof/cmdline" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
94.176.161.167 - - [08/Jun/2026:18:17:01 +1100] "GET /.git/config HTTP/1.1" 404 4024 "http://rspamd.host/.git/config" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)"
94.176.161.167 - - [08/Jun/2026:18:17:01 +1100] "GET /.aws/credentials HTTP/1.1" 404 4024 "http://rspamd.host/.aws/credentials" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)"
94.176.161.167 - - [08/Jun/2026:18:17:04 +1100] "GET
...
show less
Brute-Force
Web App Attack
🇩🇪
check-the-sum.fr
2026-06-08 06:29:55
(5 days ago)
Port Scanning
Port Scan
🇩🇪
Selckie
2026-06-08 06:22:50
(5 days ago)
fail2ban: NGINX unusual impact
Web App Attack
2026-06-07 19:48:42
(5 days ago)
$f2bV_matches
Brute-Force
🇳🇱
homeshowdomain.nl
2026-06-06 22:01:43
(6 days ago)
Auto-ban: >3000 req/min op 2026-06-06
Web App Attack
SSH
Hacking
🇫🇷
sbocquet
2026-06-06 15:41:09
(6 days ago)
Port 443 scanned from 94.176.161.167:33412.
Port Scan
🇩🇪
Hary74656
2026-06-06 12:18:21
(6 days ago)
[Sat Jun 06 14:18:09.603028 2026] [security2:error] [pid 318930:tid 318962] [remote 94.176.161.167:3 ...
show more
[Sat Jun 06 14:18:09.603028 2026] [security2:error] [pid 318930:tid 318962] [remote 94.176.161.167:39866] [client 94.176.161.167] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "26th.eu"] [uri "/.git/config"] [unique_id "aiQQAV5cFSKnFevkyR0yIgABqgA"]
[Sat Jun 06 14:18:10.691537 2026] [security2:error] [pid 318930:tid 318973] [remote 94.176.161.167:39866] [client 94.176.161.167] ModSecurity: Access denied with code 403 (phase 2). Matched phrase ".aws/credentials" at REQUEST_FILENAME. [
...
show less
Web App Attack
🇳🇿
Antinson
2026-06-06 10:01:42
(1 week ago)
High error rate and elevated request volume targeting cPanel servers
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-06 07:32:36
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 03:32:28.373373 2026] [security2:error] [pid 6951:tid 6951] [client 94.176.161.167:40294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.konahawaii.com"] [uri "/.git/config"] [unique_id "aiPNDGSg8Te2m3T-XhB4MQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-06 06:59:19
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 02:59:11.722544 2026] [security2:error] [pid 10590:tid 10590] [client 94.176.161.167:48754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "koidivision.com"] [uri "/.env.development"] [unique_id "aiPFP3zj7yt_FltzyzP93gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-06 04:50:35
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 94.176.161.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 00:50:31.973933 2026] [security2:error] [pid 26449:tid 26449] [client 94.176.161.167:52490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kmashburn.com"] [uri "/.git/config"] [unique_id "aiOnFxQAxj2J0_MeDB9FCAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack