🇩🇪
webanyone
2026-08-01 07:46:02
(7 minutes ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
ConsulHosting
2026-08-01 06:46:10
(1 hour ago)
Automatically blocked due to distributed attack
Hacking
2026-08-01 06:17:10
(1 hour ago)
$f2bV_matches
Brute-Force
🇫🇷
Catalin Negru
2026-08-01 06:06:02
(1 hour ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇮🇳
evicky2002
2026-08-01 06:00:00
(1 hour ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇨🇿
sajmon0011
2026-08-01 05:46:55
(2 hours ago)
34.125.225.154 - - [01/Aug/2026:07:46:54 +0200] "GET /.env.local HTTP/1.1" 404 196 "-" "TLM-Audit-Sc ...
show more
34.125.225.154 - - [01/Aug/2026:07:46:54 +0200] "GET /.env.local HTTP/1.1" 404 196 "-" "TLM-Audit-Scanner/1.0"
...
show less
Web App Attack
2026-08-01 05:10:04
(2 hours ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇦🇺
aranguren.org
2026-08-01 04:43:17
(3 hours ago)
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /env.json HTTP/1.1" 404 983 "-" "Mozilla/5.0 (c ...
show more
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /env.json HTTP/1.1" 404 983 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)"
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /.env HTTP/1.1" 404 983 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /.env.old HTTP/1.1" 404 983 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)"
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /.env.local HTTP/1.1" 404 983 "-" "TLM-Audit-Scanner/1.0"
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /admin/.env HTTP/1.1" 404 983 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; [email protected] )"
34.125.225.154 - - [01/Aug/2026:14:43:16 +1000] "GET /.env.development HTTP/1.1" 404 983 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://o
...
show less
Bad Web Bot
🇨🇱
Denis Chavez
2026-08-01 04:03:21
(3 hours ago)
Fail2Ban detected malicious activity on Nginx
Brute-Force
SSH
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 03:55:19
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.125.225.154 (154.225.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.225.154 (154.225.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 23:55:12.518906 2026] [security2:error] [pid 143246:tid 143246] [client 34.125.225.154:33662] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lynellejonsson.com"] [uri "/.env.staging"] [unique_id "am1uIOiAkXjquE6Aa4ORGgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-08-01 03:47:49
(4 hours ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.125.225.154 (US/United States/154. ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.125.225.154 (US/United States/154.225.125.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
show less
Hacking
🇩🇪
Dominik Lysiak
2026-08-01 03:18:09
(4 hours ago)
34.125.225.154 - - [01/Aug/2026:05:18:08 +0200] "GET /.env.bak HTTP/1.1" 200 9825 "-" "Mozilla/5.0 A ...
show more
34.125.225.154 - - [01/Aug/2026:05:18:08 +0200] "GET /.env.bak HTTP/1.1" 200 9825 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.125.225.154 - - [01/Aug/2026:05:18:09 +0200] "GET /.env.development HTTP/1.1" 200 9823 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
34.125.225.154 - - [01/Aug/2026:05:18:09 +0200] "GET /.env.old HTTP/1.1" 200 9819 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot"
...
show less
Web App Attack
🇨🇭
4server
2026-08-01 03:10:45
(4 hours ago)
[SatAug0105:10:40.0397302026][security2:error][pid1718587:tid1718904][client34.125.225.154:0]ModSecu ...
show more
[SatAug0105:10:40.0397302026][security2:error][pid1718587:tid1718904][client34.125.225.154:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"mail.edilmarra.ch\"][uri\"/.env.local\"][unique_id\"am1jsHRz-1msMaXXaSILCQAAAI4\"]
show less
Hacking
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-08-01 03:07:38
(4 hours ago)
[Fri Jul 31 21:07:38.576179 2026] [authz_core:error] [pid 41422:tid 139661154428480] [client 34.125. ...
show more
[Fri Jul 31 21:07:38.576179 2026] [authz_core:error] [pid 41422:tid 139661154428480] [client 34.125.225.154:9652] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Fri Jul 31 21:07:38.585427 2026] [authz_core:error] [pid 41424:tid 139661716477504] [client 34.125.225.154:9992] AH01630: client denied by server configuration: /var/www/horde/.env.orig
[Fri Jul 31 21:07:38.579282 2026] [authz_core:error] [pid 41423:tid 139662161061440] [client 34.125.225.154:9736] AH01630: client denied by server configuration: /var/www/horde/config/.env
...
show less
Bad Web Bot
🇩🇪
TheDjRider
2026-08-01 02:51:30
(5 hours ago)
Fail2Ban:apache-backup-scanner IP:34.125.225.154 matches:<matches[0:120]>
Port Scan
Bad Web Bot
Web App Attack