🇮🇳
evicky2002
2026-08-17 03:44:05
UTC ·
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=95, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-05-09 21:59:47
UTC ·
(6 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-08.
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-05-08 19:06:15
UTC ·
(6 months ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
Anonymous
2026-05-08 12:17:30
UTC ·
(6 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-05-08 09:40:20
UTC ·
(6 months ago)
248 requests with url.path *.env
Brute-Force
Bad Web Bot
🇲🇾
Rizzy
2026-05-08 07:18:03
UTC ·
(6 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 07:05:36
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 03:05:32.527211 2026] [security2:error] [pid 5771:tid 5 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 03:05:32.527211 2026] [security2:error] [pid 5771:tid 5880] [client 34.130.69.245:46108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.steamtech.info.faimreps.com"] [uri "/.env.local"] [unique_id "af2LPDpMc-ZL7ekHhC3E1AAAANI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 06:32:03
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 02:31:58.435840 2026] [security2:error] [pid 30623:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 02:31:58.435840 2026] [security2:error] [pid 30623:tid 30623] [client 34.130.69.245:58426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.scottbrimeyerelectric.com.helpkccare.org"] [uri "/app/.env"] [unique_id "af2DXkG-sUtvH8geGBSaLgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
antivoid.xyz
2026-05-08 06:31:55
UTC ·
(6 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 05:46:04
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:45:59.404639 2026] [security2:error] [pid 8386:tid 8 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 01:45:59.404639 2026] [security2:error] [pid 8386:tid 8386] [client 34.130.69.245:41168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "averye.com"] [uri "/.env.local"] [unique_id "af14l9fKnGUV59wR7KIJJwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 04:42:33
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:42:24.592368 2026] [security2:error] [pid 25942:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 00:42:24.592368 2026] [security2:error] [pid 25942:tid 25942] [client 34.130.69.245:41222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "boardinjapan.com"] [uri "/.env.local"] [unique_id "af1psEAG6JhhCTu30AsPRAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
seal
2026-05-08 03:46:19
UTC ·
(6 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
SSH
Brute-Force
🇺🇸
TPI-Abuse
2026-05-08 03:25:35
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:25:31.471734 2026] [security2:error] [pid 3297:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 23:25:31.471734 2026] [security2:error] [pid 3297:tid 3297] [client 34.130.69.245:56302] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.crafft.cloudex.link"] [uri "/api/.env"] [unique_id "af1Xq2oktLGnMHn_DcBx7gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wteiken
2026-05-08 03:21:06
UTC ·
(6 months ago)
www.teiken.net:443 34.130.69.245:45620 - - [07/May/2026:23:21:04 -0400] "GET /app/.env.local HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36"
www.teiken.net:443 ...
show more
www.teiken.net:443 34.130.69.245:45620 - - [07/May/2026:23:21:04 -0400] "GET /app/.env.local HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36"
www.teiken.net:443 34.130.69.245:45636 - - [07/May/2026:23:21:04 -0400] "GET /.env.dev HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (X11; U; Linux; i686; en-US; rv:1.6) Gecko Epiphany/1.2.5"
www.teiken.net:443 34.130.69.245:45612 - - [07/May/2026:23:21:04 -0400] "GET /admin/.env HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36"
www.teiken.net:443 34.130.69.245:45646 - - [07/May/2026:23:21:04 -0400] "GET /.env.development.local HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1"
www.teiken.net:443 34.130.69.245:45654 - - [07/May/2026:23:21:05 -0400] "GET /api/.env HTTP/1.1" 404 3248 "-" "Mozilla/5.0 (Linux; Androi
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 02:00:23
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 22:00:18.971024 2026] [security2:error] [pid 15140:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.130.69.245 (245.69.130.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 22:00:18.971024 2026] [security2:error] [pid 15140:tid 15140] [client 34.130.69.245:47190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.micaden.com.marshvineyards.com"] [uri "/admin/.env"] [unique_id "af1DstXrSUx57kt0qFxX2AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack