2026-07-26 03:52:10
(3 hours ago)
Reported from Nginx log analysis 16. Log: 34.138.23.193 - - [26/Jul/2026:xx:xx:xx 0200] "GET /.env ...
show more
Reported from Nginx log analysis 16. Log: 34.138.23.193 - - [26/Jul/2026:xx:xx:xx 0200] "GET /.env HTTP/1.1" xxx xxx "-" "internal-scan/1.0" "-" "US United States North Charleston" "AS396982" "Google LLC"
show less
Port Scan
Brute-Force
SSH
🇬🇧
myintarweb
2026-07-26 02:15:16
(5 hours ago)
34.138.23.193 - - [26/Jul/2026:03:15:15 +0100] 80 "GET /.env HTTP/1.1" 403 1442 "-" "internal-scan/1 ...
show more
34.138.23.193 - - [26/Jul/2026:03:15:15 +0100] 80 "GET /.env HTTP/1.1" 403 1442 "-" "internal-scan/1.0"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
Phenix Info
2026-07-26 02:11:07
(5 hours ago)
SmallGuard.fr - Forbidden Ext.
Web App Attack
🇬🇧
markawes
2026-07-26 02:09:56
(5 hours ago)
[SynFast] Auto banned by Fail2Ban. Reason: Web vulnerability scan detected. Evidence:
34.138.23.193 ...
show more
[SynFast] Auto banned by Fail2Ban. Reason: Web vulnerability scan detected. Evidence:
34.138.23.193 - - [26/Jul/2026:02:09:52 +0000] "GET /.env HTTP/1.1" 404 162 "-" "internal-scan/1.0"
34.138.23.193 - - [26/Jul/2026:02:09:56 +0000] "GET /.env HTTP/1.1" 404 162 "-" "internal-scan/1.0"
show less
Web App Attack
Port Scan
🇧🇷
Peregrine
2026-07-26 02:09:01
(5 hours ago)
Fail2Ban Jail: tomcat-honeypot | Evidence: - 34.138.23.193 - - [25/Jul/2026:23:08:53 -0300] "GET /.e ...
show more
Fail2Ban Jail: tomcat-honeypot | Evidence: - 34.138.23.193 - - [25/Jul/2026:23:08:53 -0300] "GET /.env HTTP/1.1" 404 414
show less
Bad Web Bot
🇫🇷
polido
2026-07-26 02:02:51
(5 hours ago)
[instance-20240404-1611] Unauthorized connection attempt to port 443 from 34.138.23.193
Port Scan
🇱🇻
garmtech.com
2026-07-26 01:53:11
(5 hours ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇩🇪
Bedios GmbH
2026-07-26 01:52:55
(5 hours ago)
Login credentials theft attempt
Hacking
🇺🇸
JustMeHere
2026-07-26 01:52:20
(5 hours ago)
[Sat Jul 25 21:52:17.555875 2026] [security2:error] [pid 69231:tid 69272] [client 34.138.23.193:4660 ...
show more
[Sat Jul 25 21:52:17.555875 2026] [security2:error] [pid 69231:tid 69272] [client 34.138.23.193:46602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "73.88.79.72"] [uri "/.env"] [unique_id "amVoUZDADrycsqu7Vxk6wAAAAMw"]
...
show less
Web App Attack
🇨🇭
zynex
2026-07-26 01:51:49
(5 hours ago)
URL Probing: /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 01:47:31
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.138.23.193 (193.23.138.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.138.23.193 (193.23.138.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 21:47:26.238092 2026] [security2:error] [pid 1717503:tid 1717503] [client 34.138.23.193:36378] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.56"] [uri "/.env"] [unique_id "amVnLmeX2qx85Ir08-JMoQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-07-26 01:46:32
(6 hours ago)
34.138.23.193 - - [26/Jul/2026:02:46:26 +0100] "GET /.env HTTP/1.1" 301 162 "-" "internal-scan/1.0"
...
show more
34.138.23.193 - - [26/Jul/2026:02:46:26 +0100] "GET /.env HTTP/1.1" 301 162 "-" "internal-scan/1.0"
2026/07/26 02:46:30 [error] 1770200#1770200: *1514337 access forbidden by rule, client: 34.138.23.193, server: [redacted], request: "GET /.env HTTP/1.1", host: "[redacted]:443"
34.138.23.193 - - [26/Jul/2026:02:46:30 +0100] "GET /.env HTTP/1.1" 403 2599 "-" "internal-scan/1.0"
show less
Brute-Force
Web App Attack
🇧🇷
diego
2026-07-26 01:43:48
(6 hours ago)
[probe-44-49] 2026-07-26 01:24:24, Client: 34.138.23.193, Protocol: 6, Unauthorized activity to HTTP ...
show more
[probe-44-49] 2026-07-26 01:24:24, Client: 34.138.23.193, Protocol: 6, Unauthorized activity to HTTP: GET /.env
show less
Web App Attack
🇧🇷
SOC Blue Team
2026-07-26 01:25:53
(6 hours ago)
IPs get by Hunting on SIEM
Phishing
Web Spam
Port Scan
Hacking
2026-07-26 01:23:48
(6 hours ago)
Sensitive file access attempt
Hacking