🇺🇸
TPI-Abuse
2026-09-06 03:01:14
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:01:09.403838 2026] [security2:error] [pid 18460:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:01:09.403838 2026] [security2:error] [pid 18460:tid 18460] [client 34.20.160.209:42958] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.napkinsforweddings.com"] [uri "/.env.local"] [unique_id "apzXdVCdJBue7ysohkvqvQAAAH8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-06 02:37:34
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
XICTRON
2026-09-06 02:15:07
(1 month ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇨🇭
4server
2026-09-06 00:47:45
(1 month ago)
[SunSep0602:47:42.2889062026][security2:error][pid2480174:tid2480699][client34.20.160.209:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"96072 ...
show more
[SunSep0602:47:42.2889062026][security2:error][pid2480174:tid2480699][client34.20.160.209:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"cpanel.hosting-domain-swiss.ch\"][uri\"/.env.example\"][unique_id\"apy4Lt9V4vEhvs_z0g5bDAAAARY\"]
show less
Hacking
Web App Attack
🇳🇱
e.fierstra
2026-09-06 00:34:50
(1 month ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
MyGlobalFlowers
2026-09-06 00:17:31
(1 month ago)
Multiple WAF Violations
Web App Attack
🇩🇪
raph
2026-09-06 00:00:25
(1 month ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:55:07
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:55:01.572421 2026] [security2:error] [pid 10129:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:55:01.572421 2026] [security2:error] [pid 10129:tid 10129] [client 34.20.160.209:49452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.kraftrentals.com"] [uri "/.env.backup"] [unique_id "apyr1WQ6zTtc4T-gryX5DAAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:39:14
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:39:08.046643 2026] [security2:error] [pid 22707:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.160.209 (209.160.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:39:08.046643 2026] [security2:error] [pid 22707:tid 22707] [client 34.20.160.209:46570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "guller.net"] [uri "/.env.local"] [unique_id "apyoHA6-42daY7n71XvaUgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Petros Stefanakis
2026-09-05 23:38:59
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 34.20.160.209 (US/United States/209.160.20.34.bc.googleusercontent.com)
SQL Injection
🇩🇪
Marc
2026-09-05 23:24:37
(1 month ago)
34.20.160.209 - - [06/Sep/2026:01:24:37 +0200] "GET /.env.backup HTTP/1.1" 404 4617 "-" "crusader-worker/1.0" 34.20.160.209 - - [06/Sep/2026:01:24:37 +0200] "GET /wp-config.php.swp HTTP/1.1" 404 4618 "-" "crusader-worker/1.0" 34.20.160.209 - - [06/Se ...
show more
34.20.160.209 - - [06/Sep/2026:01:24:37 +0200] "GET /.env.backup HTTP/1.1" 404 4617 "-" "crusader-worker/1.0" 34.20.160.209 - - [06/Sep/2026:01:24:37 +0200] "GET /wp-config.php.swp HTTP/1.1" 404 4618 "-" "crusader-worker/1.0" 34.20.160.209 - - [06/Sep/2026:01:24:37 +0200] "GET /_ignition/health-check HTTP/1.1" 404 4617 "-" "crusader-worker/1.0"
show less
Brute-Force
🇺🇸
mnsf
2026-09-05 23:05:34
(1 month ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
2026-09-05 23:00:28
(1 month ago)
Web scanner: GET /.env.example
Web App Attack
Hacking
🇩🇪
NewGastroline
2026-09-05 22:59:40
(1 month ago)
Malicious request blocked by CrowdSec on gastro-prod1.boreus.de
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-09-05 22:55:56
(1 month ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
