🇫🇮
JimArchon72
2026-08-29 08:25:01
(24 minutes ago)
2026/08/29 08:24:47 "GET /wp-login.php HTTP/1.1"
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 07:06:58
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 03:06:54.643306 2026] [security2:error] [pid 5219:tid 5219] [client 34.125.114.121:56674] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "memoriesmusic.net.controvac.com"] [uri "/@fs/app/.env"] [unique_id "apKFDkSVyIWWCmU59qYXRwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-08-29 06:50:06
(1 hour ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 06:39:38
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 02:39:34.257682 2026] [security2:error] [pid 15764:tid 15764] [client 34.125.114.121:31678] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.coinbracelet.com"] [uri "/@fs/app/.env"] [unique_id "apJ-pqGTmTgoAwO3zBXKlAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-08-29 06:37:29
(2 hours ago)
34.125.114.121 - - [29/Aug/2026:08:37:25 +0200] "GET /@fs/home/node/.aws/config?raw?? HTTP/1.1" 404 ...
show more
34.125.114.121 - - [29/Aug/2026:08:37:25 +0200] "GET /@fs/home/node/.aws/config?raw?? HTTP/1.1" 404 761 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)"
34.125.114.121 - - [29/Aug/2026:08:37:25 +0200] "GET /@fs/.env.local?raw?? HTTP/1.1" 404 761 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.3791.207 Safari/537.36; compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.125.114.121 - - [29/Aug/2026:08:37:25 +0200] "GET /@fs/.env.production?raw?? HTTP/1.1" 404 761 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/crawler) Chrome/131.0.5766.235 Safari/537.36 Edg/131.0.5766.235"
34.125.114.121 - - [29/Aug/2026:08:37:25 +0200] "GET /@fs/home/node/.aws/credentials?raw?? HTTP/1.1" 404 761 "-" "Mozilla/5.0 (Linux; Android
show less
Web App Attack
Hacking
🇫🇷
masterguru
2026-08-29 05:40:29
(3 hours ago)
Restricted File Access Attempt. Matched phrase "/@fs/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 04:54:41
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 00:54:35.240027 2026] [security2:error] [pid 2846:tid 2846] [client 34.125.114.121:8630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eventos.gabosoftware.com"] [uri "/@fs/app/.env"] [unique_id "apJmCx9Z9avcQLnvDZg-fwAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-08-29 04:47:18
(4 hours ago)
env leak on 813.today/@fs/home/ubuntu/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇩🇪
updown.io
2026-08-29 04:37:25
(4 hours ago)
{"level":"info","ts":1787978217.5921972,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1787978217.5921972,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.125.114.121","remote_port":"31834","client_ip":"34.125.114.121","proto":"HTTP/1.1","method":"GET","host":"status.lucidtales.coop","uri":"/","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"]}},"bytes_read":0,"user_id":"","duration":0.000072729,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.lucidtales.coop/"],"Content-Type":[]}}
{"level":"info","ts":1787978221.8750503,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.125.114.121","remote_port":"5516","client_ip":"34.125.114.121","proto":"HTTP/1.1","method":"GET","host":"status.lucidtales.coop","uri":"/@fs/proc/self/environ?raw??","headers":{"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0
...
show less
DDoS Attack
Web App Attack
🇳🇿
Antinson
2026-08-29 04:31:59
(4 hours ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇳🇱
Site.eu
2026-08-29 04:30:57
(4 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-08-29 04:02:49
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.114.121 (121.114.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 00:02:45.072940 2026] [security2:error] [pid 30250:tid 30270] [client 34.125.114.121:63862] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kyrameadows.com"] [uri "/@fs/.env"] [unique_id "apJZ5Q1qzmFMpsmWRTd6GAAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-08-29 03:53:36
(4 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-08-29 03:50:18
(4 hours ago)
Try to access /@fs/src/.env?raw??
Web App Attack
🇫🇷
Lunix
2026-08-29 03:45:33
(5 hours ago)
Brute-Force
Web App Attack