🇫🇷
SpaceHost-Server
2026-10-13 22:19:15
(14 hours ago)
Brute-Force
Web App Attack
🇺🇸
snappic
2026-10-13 00:34:39
(1 day ago)
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (c ...
show more
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)]
show less
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-10-13 00:10:36
(1 day ago)
2026/10/13 00:10:34 [error] 3179999#3179999: *45355757 access forbidden by rule, client: 34.13.214.2 ...
show more
2026/10/13 00:10:34 [error] 3179999#3179999: *45355757 access forbidden by rule, client: 34.13.214.238, server: fn.binixo.mx, request: "GET /.env.supabase HTTP/2.0", host: "fn.binixo.mx"
2026/10/13 00:10:34 [error] 3179997#3179997: *45355745 access forbidden by rule, client: 34.13.214.238, server: fn.binixo.mx, request: "GET /.npmrc HTTP/2.0", host: "fn.binixo.mx"
2026/10/13 00:10:34 [error] 3179997#3179997: *45355756 access forbidden by rule, client: 34.13.214.238, server: fn.binixo.mx, request: "GET /.dev.vars HTTP/2.0", host: "fn.binixo.mx"
...
show less
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-12 22:18:39
(1 day ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 19:52:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 15:52:08.638160 2026] [security2:error] [pid 21112:tid 21112] [client 34.13.214.238:54310] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.railsolutions.mx"] [uri "/static//home/user/.env"] [unique_id "as06aPgPjITi2MjOV6r98wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 15:46:12
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:46:07.162538 2026] [security2:error] [pid 1773:tid 1773] [client 34.13.214.238:57068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ecuablue.farm"] [uri "/cache/original/%2e%2e/.env"] [unique_id "as0Av_7rOBBnlBJ0AEpuAwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:15:28
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:15:21.019403 2026] [security2:error] [pid 7321:tid 7321] [client 34.13.214.238:51702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "admin.casaniagara.com.mx.elpais.mx"] [uri "/uploads../.env"] [unique_id "aszreSiEBoaDvGcBbhhr0gAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 13:50:59
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 09:50:51.073788 2026] [security2:error] [pid 2842:tid 2842] [client 34.13.214.238:47558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ultratecnologia.com.mx"] [uri "/static//.env"] [unique_id "aszlu5RiLVGmOhxl6OAfGgAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 13:34:24
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 09:34:18.336680 2026] [security2:error] [pid 10323:tid 10323] [client 34.13.214.238:52444] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "radiofamilia.com.mx"] [uri "/uploads../.env"] [unique_id "aszh2lqyU2OuRdVKrlvtmwAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
OceanTreasure
2026-10-12 13:27:22
(1 day ago)
tcp/443; PHP-CGI argument injection exploit attempt (CVE-2012-1823 / CVE-2024-4577) forcing auto_pre ...
show more
tcp/443; PHP-CGI argument injection exploit attempt (CVE-2012-1823 / CVE-2024-4577) forcing auto_prepend_file to php://input for remote code execution, lowercase-hex variant sent to /index.php, /cgi-bin/php and /php-cgi/php-cgi.exe: "POST /index.php?%ADd+
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 13:11:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 09:11:31.377176 2026] [security2:error] [pid 15495:tid 15495] [client 34.13.214.238:48356] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lightningbug.farm"] [uri "/.env"] [unique_id "aszcg3_6FM9colnzKqt4CgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dtorrer
2026-10-12 13:00:19
(2 days ago)
General vulnerability scan.
Port Scan
🇺🇸
TPI-Abuse
2026-10-12 12:35:52
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.13.214.238 (238.214.13.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 08:35:47.232382 2026] [security2:error] [pid 30585:tid 30585] [client 34.13.214.238:47130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "imerka.com.mx"] [uri "/uploads../.env"] [unique_id "aszUI3PFKmJtII2RLaY9MwAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Omar Martínez
2026-10-12 11:54:08
(2 days ago)
[Mon Oct 12 05:54:06.066803 2026] [core:error] [pid 2139627:tid 139843211888192] [remote 34.13.214.2 ...
show more
[Mon Oct 12 05:54:06.066803 2026] [core:error] [pid 2139627:tid 139843211888192] [remote 34.13.214.238:53836] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 12 05:54:06.094257 2026] [core:error] [pid 2139627:tid 139843077596736] [remote 34.13.214.238:53836] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
...
show less
Phishing
Email Spam
Blog Spam
🇩🇪
rzk
2026-10-12 11:41:02
(2 days ago)
CrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-eve ...
show more
CrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-event detection. ASN: GOOGLE-CLOUD-PLATFORM. Country: NL. Timestamp: 2026-10-12T11:41:02+00:00.
show less
Bad Web Bot
Web App Attack
