2026-06-11 18:16:26
(4 hours ago)
Blocked by ModSec and CSF
Port Scan
2026-06-11 15:25:55
(7 hours ago)
(caddyscan) Scanner path probe from 34.104.148.122 (JP/Japan/122.148.104.34.bc.googleusercontent.com ...
show more
(caddyscan) Scanner path probe from 34.104.148.122 (JP/Japan/122.148.104.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.104.148.122 - - [11/Jun/2026:15:25:51 +0000] "GET /.env.production.bak HTTP/1.1"
[REDACTED] 200 2627 34.104.148.122 - - [11/Jun/2026:15:25:51 +0000] "GET /.env.old HTTP/1.1"
[REDACTED] 200 2627 34.104.148.122 - - [11/Jun/2026:15:25:51 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 34.104.148.122 - - [11/Jun/2026:15:25:51 +0000] "GET /.env.bak HTTP/1.1"
[REDACTED] 200 2627 34.104.148.122 - - [11/Jun/2026:15:25:51 +0000] "GET /.env.production HTTP/1.1"
show less
Port Scan
🇳🇱
Site.eu
2026-06-11 12:52:50
(9 hours ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
debestelapp
2026-06-11 11:20:06
(11 hours ago)
Web App Attack
🇩🇪
iNetWorker
2026-06-11 06:37:00
(15 hours ago)
trolling for resource vulnerabilities
Web App Attack
🇳🇱
Savvii
2026-06-11 04:02:29
(18 hours ago)
20 attempts against mh-misbehave-ban on burne
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-10 23:31:36
(23 hours ago)
34.104.148.122 - - [11/Jun/2026:02:31:36 +0300] "GET /.env HTTP/1.1" 404 3295 "-" "Mozilla/5.0 (Maci ...
show more
34.104.148.122 - - [11/Jun/2026:02:31:36 +0300] "GET /.env HTTP/1.1" 404 3295 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0"
34.104.148.122 - - [11/Jun/2026:02:31:36 +0300] "GET /prod/.env HTTP/1.1" 404 3296 "-" "Mozilla/5.0 (Linux; U; Android 2.2; en-us; Sprint APA9292KT Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
...
show less
Web App Attack
🇧🇪
cmbplf
2026-06-10 15:44:28
(1 day ago)
627 requests with url.path *.env
Brute-Force
Bad Web Bot
🇫🇷
masterguru
2026-06-10 15:37:42
(1 day ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.104.148.122 (JP/Japan/122.148.104. ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.104.148.122 (JP/Japan/122.148.104.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
show less
Hacking
🇩🇪
updown.io
2026-06-10 13:19:22
(1 day ago)
{"level":"info","ts":1781097561.2311487,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781097561.2311487,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.104.148.122","remote_port":"46650","client_ip":"34.104.148.122","proto":"HTTP/1.1","method":"GET","host":"edcbupdate.zyxwupdate.onqponmlkjihgbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/env","headers":{"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (X11; U; Linux arm7tdmi; rv:1.8.1.11) Gecko/20071130 Minimo/0.025"],"Accept-Charset":["utf-8"]}},"bytes_read":0,"user_id":"","duration":0.000084582,"size":0,"status":308,"resp_headers":{"Content-Type":[],"Server":["Caddy"],"Connection":["close"],"Location":["https://edcbupdate.zyxwupdate.onqponmlkjihgbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/env"]}}
{"level":"info","ts":1781097561.2902133,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.104.148.122","remote_port":"46666","client_ip":"34.104.148.122","
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 13:05:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 09:05:07.715699 2026] [security2:error] [pid 11147:tid 11147] [client 34.104.148.122:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cdn-0.socialstudiesforkids.com"] [uri "/uploads/.env"] [unique_id "ailhA0jsjUUF_Zl9UhWergAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 09:57:38
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 05:57:33.927758 2026] [security2:error] [pid 18394:tid 18394] [client 34.104.148.122:39352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.reserve.sanjuangrange.org"] [uri "/.env.prod.bak"] [unique_id "aik1DZW-zRS_rYO7jIEQMgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 08:50:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 04:50:19.810557 2026] [security2:error] [pid 738:tid 738] [client 34.104.148.122:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sistememail.com"] [uri "/.env"] [unique_id "aiklSzQEfciVuvzZZgcasgAAAHk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 02:34:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.104.148.122 (122.148.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 22:34:02.993378 2026] [security2:error] [pid 25474:tid 25492] [client 34.104.148.122:47028] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "workbykathryn.com"] [uri "/.env.production"] [unique_id "aijNGtmptmbdhAELRGEcUgAAAYg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-06-10 01:37:29
(1 day ago)
Web attack/malicious scanning detected
Web App Attack