🇳🇱
homeshowdomain.nl
2026-09-08 22:00:49
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-07.
show less
Web App Attack
SSH
Hacking
🇺🇸
IndigoRidge
2026-09-07 20:22:47
(1 month ago)
[Mon Sep 07 16:22:00.589840 2026] [authz_core:error] [pid 4020:tid 140581594461952] [client 34.28.17 ...
show more
[Mon Sep 07 16:22:00.589840 2026] [authz_core:error] [pid 4020:tid 140581594461952] [client 34.28.170.64:0] AH01630: client denied by server configuration: /var/www/vhosts/default/htdocs/laravel
[Mon Sep 07 16:22:00.646415 2026] [authz_core:error] [pid 4016:tid 140582307284736] [client 34.28.170.64:0] AH01630: client denied by server configuration: /var/www/vhosts/default/htdocs/web
[Mon Sep 07 16:22:19.549195 2026] [authz_core:error] [pid 4322:tid 140581040805632] [client 34.28.170.64:0] AH01630: client denied by server configuration: /var/www/vhosts/default/htdocs/wp-config.php.bak
[Mon Sep 07 16:22:19.575193 2026] [authz_core:error] [pid 4322:tid 140581049198336] [client 34.28.170.64:0] AH01630: client denied by server configuration: /var/www/vhosts/default/htdocs/config
[Mon Sep 07 16:22:47.053277 2026] [authz_core:error] [pid 4322:tid 140582156478208] [client 34.28.170.64:0] AH01630: client denied by server configuration: /var/www/vhosts/default/htdocs/client
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 20:20:01
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 16:19:54.134328 2026] [security2:error] [pid 7818:tid 7818] [client 34.28.170.64:63640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prospects.caribbeancoders.com"] [uri "/@fs/root/.env"] [unique_id "ap8cag9kfSh1Q7mbptlBQAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 19:40:41
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 15:40:34.021927 2026] [security2:error] [pid 19793:tid 19809] [client 34.28.170.64:37370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "plasticsurgeonsandiego.com.aafm.us"] [uri "/@fs/root/.env"] [unique_id "ap8TMoMT5RobvYSQfLGsnQAAAM0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Catalin Negru
2026-09-07 19:36:36
(1 month ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇩🇪
Petros Stefanakis
2026-09-07 19:32:54
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 34.28.170.64 (US/United States/64.170.2 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.28.170.64 (US/United States/64.170.28.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-09-07 19:02:05
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 15:02:01.919831 2026] [security2:error] [pid 18978:tid 18978] [client 34.28.170.64:33474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "godplusus.com"] [uri "/@fs/.env.production"] [unique_id "ap8KKRR3UhStXQFfgYlhnAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 18:28:05
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.28.170.64 (64.170.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 14:27:57.628908 2026] [security2:error] [pid 16153:tid 16153] [client 34.28.170.64:53216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.moontouchmassage.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252froot/.env"] [unique_id "ap8CLalSZou-pS9CF6W-NAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-07 17:41:18
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇮🇹
VHosting
2026-09-07 17:25:02
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-09-07 17:21:09
(1 month ago)
Attempted access to sensitive endpoint (/@fs/../.env?raw??) detected. Automated scan or unauthorized ...
show more
Attempted access to sensitive endpoint (/@fs/../.env?raw??) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇫🇷
Octopuce
2026-09-07 16:47:33
(1 month ago)
Aggressive web search of vulnerable pages: /.docker/.env /v2/.env /.env.local /images../.env /v1/.en ...
show more
Aggressive web search of vulnerable pages: /.docker/.env /v2/.env /.env.local /images../.env /v1/.env ...
show less
Web App Attack
🇩🇪
filstal.org
2026-09-07 16:18:01
(1 month ago)
Web exploit or injection attempt blocked by ModSecurity WAF.
SQL Injection
Web App Attack
🇳🇱
Site.eu
2026-09-07 15:29:59
(1 month ago)
Excessive 404/403 errors
Brute-Force
