Anonymous
2026-09-03 10:30:20
(1 month ago)
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web se ...
show more
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web server.
show less
Web App Attack
Bad Web Bot
Anonymous
2026-09-01 14:07:05
(1 month ago)
Automated web scanner. Requested suspicious paths: /.env.backup | /.env.old | /.env.production | /.e ...
show more
Automated web scanner. Requested suspicious paths: /.env.backup | /.env.old | /.env.production | /.env.example | /.env.local | /.env.save | /_ignition/health-check | /.env.bak | /.env.prod | /actuator/configprops | /.env | /.env.dev | /actuator/env. UTC: 2026-09-01 13:59:54.
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 14:05:36
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 10:05:30.151862 2026] [security2:error] [pid 2443:tid 2443] [client 34.146.167.21:53760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.e-zschedule.com"] [uri "/.env"] [unique_id "apbbqi2nlRNYSYnsPdbG9gAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 13:49:42
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:49:34.697787 2026] [security2:error] [pid 17978:tid 17978] [client 34.146.167.21:49580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.securityzonepr.com"] [uri "/wp-config.php~"] [unique_id "apbX7qxm74jlyCb46fvX1wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 12:48:57
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:48:50.542630 2026] [security2:error] [pid 21249:tid 21249] [client 34.146.167.21:33376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "po.itimetable21.com"] [uri "/.env.prod"] [unique_id "apbJsjvv7G0tSu-pZImL8QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ธ๐ช
vaia.cloud
2026-09-01 12:45:02
(1 month ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 12:21:23
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:21:16.442562 2026] [security2:error] [pid 22238:tid 22273] [client 34.146.167.21:48884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "schoprint.com"] [uri "/.env"] [unique_id "apbDPBMcZO0zCjph-eGz0wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
dbmwebdesign
2026-09-01 12:10:04
(1 month ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
Anonymous
2026-09-01 12:04:06
(1 month ago)
34.146.167.21 - - [01/Sep/2026:14:03:59 +0200] "GET /wp-config.php.swp HTTP/1.1" 403 146 "-" "crusad ...
show more
34.146.167.21 - - [01/Sep/2026:14:03:59 +0200] "GET /wp-config.php.swp HTTP/1.1" 403 146 "-" "crusader-worker/1.0"
...
show less
Web App Attack
๐ฉ๐ช
FeG Deutschland
2026-09-01 11:14:16
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 11:09:42
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:09:35.172407 2026] [security2:error] [pid 5854:tid 5854] [client 34.146.167.21:58690] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.buanamegah.com"] [uri "/.env.local"] [unique_id "apaybzQlanHtScbYYVvA9AAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 10:46:34
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:46:30.602287 2026] [security2:error] [pid 9369:tid 9369] [client 34.146.167.21:35714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peterjohnsonpoet.peterjohnsonya.com"] [uri "/wp-config.php.bak"] [unique_id "apatBo-KuSnjAzOWkQRQVAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-01 10:13:13
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:13:08.646505 2026] [security2:error] [pid 8267:tid 8267] [client 34.146.167.21:36626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acmax.com"] [uri "/.env.prod"] [unique_id "apalNPPKN9GoY2ujmqjunwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
masterguru
2026-09-01 09:25:21
(1 month ago)
Attempt to access a backup or working file. Pattern match "\\\\. (920500-195)
Hacking
๐บ๐ธ
TPI-Abuse
2026-09-01 08:31:11
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.167.21 (21.167.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:31:07.303615 2026] [security2:error] [pid 15932:tid 15932] [client 34.146.167.21:60140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "manzilly.gulftelecom.com"] [uri "/.env.old"] [unique_id "apaNS24Qsq8yS6M-xjoXJwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack