🇳🇱
homeshowdomain.nl
2026-09-02 21:59:43
(8 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-01.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-01 13:54:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:54:31.002819 2026] [security2:error] [pid 17253:tid 17253] [client 34.102.28.184:51520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.kccares.help"] [uri "/wp-config.php.bak"] [unique_id "apbZF5psqKzfLavM_u0mGgAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 13:13:20
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:13:16.443790 2026] [security2:error] [pid 9554:tid 9554] [client 34.102.28.184:54974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lapsychiatrist.com"] [uri "/.env.old"] [unique_id "apbPbMh5sbQ1M4lfAH4qzwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 12:55:02
(1 day ago)
suspicious request in access.log
Web App Attack
2026-09-01 12:52:31
(1 day ago)
Scenarios: http-probing, http-sensitive-files
Total requests: 19
Web App Attack
🇳🇱
debestelapp
2026-09-01 12:50:09
(1 day ago)
Web App Attack
🇦🇺
paulshipley.com.au
2026-09-01 12:46:30
(1 day ago)
[Tue Sep 01 22:46:29.674464 2026] [security2:error] [pid 249707] [client 34.102.28.184:50472] [clien ...
show more
[Tue Sep 01 22:46:29.674464 2026] [security2:error] [pid 249707] [client 34.102.28.184:50472] [client 34.102.28.184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/.env.bak"] [unique_id "apbJJd09tGXXL47m1nV6eQAAAAM"]
...
show less
Web App Attack
2026-09-01 11:22:03
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env.prod HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.en ...
show more
Bot / scanning and/or hacking attempts: GET /.env.prod HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env HTTP/1.1, GET /env HTTP/1.1, GET /wp-config.php~ HTTP/1.1
show less
Hacking
Web App Attack
🇦🇺
nzhost.co.nz
2026-09-01 11:15:20
(1 day ago)
$f2bV_matches
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-09-01 11:03:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:03:03.925116 2026] [security2:error] [pid 11472:tid 11472] [client 34.102.28.184:51020] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.baker15.com"] [uri "/wp-config.php.bak"] [unique_id "apaw5-2CNSGoQqgkh4QtvAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 09:50:16
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:50:11.398386 2026] [security2:error] [pid 20082:tid 20171] [client 34.102.28.184:45762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "spoiledknottypets.com.petsentiments.com"] [uri "/wp-config.php.bak"] [unique_id "apaf00zo3XFLOK5zIgB4wgAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-01 09:43:22
(1 day ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.102.28.184 (US/United States/184.2 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.102.28.184 (US/United States/184.28.102.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
show less
Hacking
🇩🇪
LRob
2026-09-01 09:28:31
(1 day ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php~ (+12 more) | 2026-09-01 09:28 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:54:26
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.102.28.184 (184.28.102.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:54:22.396698 2026] [security2:error] [pid 22479:tid 22479] [client 34.102.28.184:35558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sianti.com"] [uri "/wp-config.php~"] [unique_id "apaSvkJbfhtT3lSdYy0VIgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
SkyDancer
2026-09-01 08:48:15
(1 day ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH