🇺🇸
TPI-Abuse
2026-08-28 00:28:16
(5 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 20:28:12.101315 2026] [security2:error] [pid 18541:tid 18571] [client 34.125.248.178:20082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.magnetbay.com"] [uri "/@fs/app/.env"] [unique_id "apDWHGG8VyGirw4uykfN4wAAAFE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
conseilgouz
2026-08-28 00:25:50
(7 minutes ago)
hae-7 : Trying access unauthorized files/dir=>/@fs/home/admin/.aws/credentials?raw?
Hacking
🇺🇸
TPI-Abuse
2026-08-27 23:30:34
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 19:30:26.755002 2026] [security2:error] [pid 22421:tid 22421] [client 34.125.248.178:44190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.darrowco.com"] [uri "/@fs/.env"] [unique_id "apDIkjuBljW2LED-SdUGyAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-27 23:30:02
(1 hour ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 23:12:39
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 19:12:32.997919 2026] [security2:error] [pid 3364193:tid 3364218] [client 34.125.248.178:25564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ellicottville.net"] [uri "/@fs/root/.env"] [unique_id "apDEYGFrw0a5QvBUUd_miwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-08-27 23:09:30
(1 hour ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Site.eu
2026-08-27 22:16:23
(2 hours ago)
Excessive multi-domain requests
Brute-Force
🇨🇭
Origon
2026-08-27 21:08:53
(3 hours ago)
http-probing - IP: 34.125.248.178 - time="2026-08-27T23:08:52+02:00" level=info msg="(555f66b4f6a74 ...
show more
http-probing - IP: 34.125.248.178 - time="2026-08-27T23:08:52+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 34.125.248.178 (US/396982) : 4h ban on Ip 34.125.248.178" module=db
show less
Web App Attack
🇫🇷
Octopuce
2026-08-27 20:58:47
(3 hours ago)
Aggressive web search of vulnerable pages: /_nuxt/../.env /uploads../.env /v1/.env /img../.env /imag ...
show more
Aggressive web search of vulnerable pages: /_nuxt/../.env /uploads../.env /v1/.env /img../.env /images../.env ...
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-08-27 20:48:58
(3 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇮🇹
VHosting
2026-08-27 20:35:05
(3 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
middelkoopcc
2026-08-27 20:18:04
(4 hours ago)
2026-08-27 22:16:13 AH10244: invalid URI path (/@fs/../../.env?raw??) && 2026-08-27 22:16:25 AH10244 ...
show more
2026-08-27 22:16:13 AH10244: invalid URI path (/@fs/../../.env?raw??) && 2026-08-27 22:16:25 AH10244: invalid URI path (/@fs/../../../../../root/.env?raw??) && 2026-08-27 22:16:25 AH10244: invalid URI path (/@fs/../../../../../app/.env?raw??) && 134 more within 20 minutes
show less
Web App Attack
🇳🇱
Alboweb B.V.
2026-08-27 20:11:07
(4 hours ago)
Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail
Bad Web Bot
🇺🇸
mnsf
2026-08-27 20:05:21
(4 hours ago)
Scanning/Probing (26)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 19:37:07
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.125.248.178 (178.248.125.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 15:37:03.031655 2026] [security2:error] [pid 7323:tid 7444] [client 34.125.248.178:7116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.boracayboats.com"] [uri "/@fs/app/.env"] [unique_id "apCR3_ne9eOBn6uhxkmFVQAAAQE"]
show less
Brute-Force
Bad Web Bot
Web App Attack