🇫🇷
GabrielJST
2026-06-15 13:44:55
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.101.202.220 (ID/Indonesia/220.202.10 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.101.202.220 (ID/Indonesia/220.202.101.34.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
🇵🇱
lns.bz
2026-06-15 12:40:44
(1 day ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 05:59:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 01:58:59.560379 2026] [security2:error] [pid 381:tid 381] [client 34.101.202.220:55360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dusty.ubuciko.com"] [uri "/.env.save"] [unique_id "ai-Uo4JKZMQHkhBOBCupuQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 05:30:46
(1 day ago)
34.101.202.220 - - [15/Jun/2026:07:30:43 +0200] "GET /.env.backup HTTP/1.1" 404 437 "-" "Mozilla/5.0 ...
show more
34.101.202.220 - - [15/Jun/2026:07:30:43 +0200] "GET /.env.backup HTTP/1.1" 404 437 "-" "Mozilla/5.0 (Linux; U; Android 7.0; es-es; Redmi Note 4 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.141 Mobile Safari/537.36 XiaoMi/MiuiBrowser/10.9.7-g"
34.101.202.220 - - [15/Jun/2026:07:30:43 +0200] "GET /.env.backup HTTP/1.1" 404 243 "-" "Mozilla/5.0 (Linux; U; Android 7.0; es-es; Redmi Note 4 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.141 Mobile Safari/537.36 XiaoMi/MiuiBrowser/10.9.7-g"
34.101.202.220 - - [15/Jun/2026:07:30:43 +0200] "GET /api/.env.prod HTTP/1.1" 404 437 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.35 Safari/537.36"
34.101.202.220 - - [15/Jun/2026:07:30:43 +0200] "GET /api/.env.prod HTTP/1.1" 404 243 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.35 Safari/537.36"
34.101.202.2
...
show less
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-15 00:19:32
(1 day ago)
{"level":"info","ts":1781482769.9213326,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781482769.9213326,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.101.202.220","remote_port":"35336","client_ip":"34.101.202.220","proto":"HTTP/1.1","method":"GET","host":"status.not.futbol","uri":"/.env.copy","headers":{"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/74.0.3729.121 Mobile/15E148 Safari/605.1"],"Accept-Charset":["utf-8"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.not.futbol","ech":false}},"bytes_read":0,"user_id":"","duration":0.000157691,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1781482770.0336268,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.101.202.220","remote_port":"35352","client_ip":"34.101.202.220","proto":"HTTP
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 00:04:13
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 20:04:09.969934 2026] [security2:error] [pid 8212:tid 8212] [client 34.101.202.220:33100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "simplybrandedllc.com"] [uri "/src/.env.backup"] [unique_id "ai9BeYmVMdn_IjPGqf4SDQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-06-14 23:58:36
(1 day ago)
IM360 WAF: Direct access to sensitive file or dotfile MV:/api/.env
Web App Attack
🇩🇪
MBombeck
2026-06-14 18:03:55
(2 days ago)
Fail2Ban/traefik-botsearch on ops-01.bombeck.io: banned after 5 failures
Web App Attack
🇳🇱
Savvii
2026-06-14 17:58:04
(2 days ago)
20 attempts against mh-misbehave-ban on flow
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-14 13:47:09
(2 days ago)
Multiple WAF Violations
Web App Attack
🇫🇷
masterguru
2026-06-14 07:44:00
(2 days ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇮🇹
VHosting
2026-06-14 03:10:03
(2 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 01:44:45
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.101.202.220 (220.202.101.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 21:44:37.338567 2026] [security2:error] [pid 1456:tid 1472] [client 34.101.202.220:44942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.cookmanufacturinggroup.com"] [uri "/.env~"] [unique_id "ai4HhQgVUJARebz4qjfNXAAAAI0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
drewf.ink
2026-06-13 19:52:09
(2 days ago)
[19:52] Port scanning. Port(s) scanned: TCP/8888, TCP/2087
Port Scan
🇺🇸
baltic-lab.com
2026-06-13 19:25:05
(2 days ago)
2026-06-13T21:24:31.600991+02:00 us kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:57:66:9b:c8:08:8b: ...
show more
2026-06-13T21:24:31.600991+02:00 us kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:57:66:9b:c8:08:8b:ff:ce:a1:08:00 SRC=34.101.202.220 DST=89.117.22.226 LEN=40 TOS=0x00 PREC=0x00 TTL=252 ID=59144 PROTO=TCP SPT=58667 DPT=8290 WINDOW=1024 RES=0x00 SYN URGP=0
2026-06-13T21:24:52.784265+02:00 us kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:57:66:9b:c8:08:8b:ff:ce:a1:08:00 SRC=34.101.202.220 DST=89.117.22.226 LEN=40 TOS=0x00 PREC=0x60 TTL=251 ID=1282 PROTO=TCP SPT=58667 DPT=6060 WINDOW=1024 RES=0x00 SYN URGP=0
2026-06-13T21:25:02.561776+02:00 us kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:57:66:9b:c8:08:8b:ff:ce:a1:08:00 SRC=34.101.202.220 DST=89.117.22.226 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=29189 PROTO=TCP SPT=58667 DPT=9004 WINDOW=1024 RES=0x00 SYN URGP=0
2026-06-13T21:25:02.959784+02:00 us kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:57:66:9b:c8:08:8b:ff:ce:a1:08:00 SRC=34.101.202.220 DST=89.117.22.226 LEN=40 TOS=0x00 PREC=0x00 TTL=252 ID=62009 PROTO=TCP SPT=58667 DPT=9202 WINDOW
...
show less
Brute-Force
Hacking