๐ฎ๐ณ
evicky2002
2026-08-31 00:01:03
(16 hours ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
Anonymous
2026-08-30 04:21:19
(1 day ago)
WordPress Sensitive System Files Information Disclosure.
Hacking
๐ฉ๐ช
eposs-it.de
2026-08-30 03:50:19
(1 day ago)
Blocked by os-abuseipdb; 38 hits, proto=tcp, ports=5001
Port Scan
Hacking
๐บ๐ธ
Rayulcifer
2026-08-30 03:32:45
(1 day ago)
34.10.168.102 - - [29/Aug/2026:22:32:43 -0500] "GET /.env.prod HTTP/1.1" 403 6743 "-" "crusader-work ...
show more
34.10.168.102 - - [29/Aug/2026:22:32:43 -0500] "GET /.env.prod HTTP/1.1" 403 6743 "-" "crusader-worker/1.0"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
Anonymous
2026-08-30 03:32:08
(1 day ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.10.168.102 (US/United States/102.168.10.3 ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.10.168.102 (US/United States/102.168.10.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.10.168.102 - - [30/Aug/2026:05:32:07 +0200] "GET /.env HTTP/1.1" 406 4831 "-" "crusader-worker/1.0"
34.10.168.102 - - [30/Aug/2026:05:32:07 +0200] "GET /.env.backup HTTP/1.1" 406 4830 "-" "crusader-worker/1.0"
34.10.168.102 - - [30/Aug/2026:05:32:07 +0200] "GET /.env.example HTTP/1.1" 406 4830 "-" "crusader-worker/1.0"
show less
Port Scan
Anonymous
2026-08-30 03:30:16
(1 day ago)
Spring Boot Actuator trap
Port Scan
Hacking
Web App Attack
๐ณ๐ฑ
homeshowdomain.nl
2026-08-29 22:00:46
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-28.
show less
Web App Attack
SSH
Hacking
๐บ๐ธ
TPI-Abuse
2026-08-29 03:32:00
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 23:31:56.875101 2026] [security2:error] [pid 87682:tid 87684] [client 34.10.168.102:56264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stephanie.stauffer.name"] [uri "/.env.example"] [unique_id "apJSrIGTbCiobpHld9pnvQAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฎ๐น
Inartis
2026-08-29 03:04:12
(2 days ago)
34.10.168.102 - - [29/Aug/2026:05:04:10 +0200] "GET /.env.local HTTP/1.1" 403 5734 "-" "crusader-wor ...
show more
34.10.168.102 - - [29/Aug/2026:05:04:10 +0200] "GET /.env.local HTTP/1.1" 403 5734 "-" "crusader-worker/1.0"
34.10.168.102 - - [29/Aug/2026:05:04:10 +0200] "GET /.env.bak HTTP/1.1" 403 5734 "-" "crusader-worker/1.0"
34.10.168.102 - - [29/Aug/2026:05:04:10 +0200] "GET /.env.old HTTP/1.1" 403 5734 "-" "crusader-worker/1.0"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-29 02:18:20
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:18:14.818284 2026] [security2:error] [pid 19441:tid 19441] [client 34.10.168.102:60110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.unwaved.com"] [uri "/.env.bak"] [unique_id "apJBZtAnMD1qQCqzgzAXJAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-08-29 01:51:59
(2 days ago)
Banned by Fail2Ban on server
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-29 01:29:32
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 21:29:25.974142 2026] [security2:error] [pid 19228:tid 19228] [client 34.10.168.102:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcbrude.com"] [uri "/.env"] [unique_id "apI19aa-Dn5_1BzDKlWsqAAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-29 00:44:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.10.168.102 (102.168.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 20:43:59.141510 2026] [security2:error] [pid 21302:tid 21302] [client 34.10.168.102:33484] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marketing.evai.is"] [uri "/.env.bak"] [unique_id "apIrT6rzso4oenbo2grnxwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ต๐ฑ
Budyn
2026-08-29 00:31:36
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: p.budyn.wtf | URI: /.env.backup | UA: crusader-worker/1.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
๐ซ๐ท
โจ
2026-08-29 00:09:09
(2 days ago)
Domain : dragonthoughts.com
Rule : env
2026-08-29 00:07:58 ***hidden-privacy*** GET /.env.bak - 443 ...
show more
Domain : dragonthoughts.com
Rule : env
2026-08-29 00:07:58 ***hidden-privacy*** GET /.env.bak - 443 - 34.10.168.102 HTTP/1.1 crusader-worker/1.0 - dragonthoughts.com 301 0 0 448 98 100 - -
show less
Hacking
SQL Injection