🇺🇸
Starburst SysOp Team
2026-08-28 12:34:42
(6 hours ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-13)
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-28 11:52:40
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 07:52:33.195902 2026] [security2:error] [pid 30175:tid 30175] [client 34.139.154.138:38208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wlsn.com"] [uri "/.env.bak"] [unique_id "apF2gZrWHshA_wcEQyYIJwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 11:08:22
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 07:08:17.807241 2026] [security2:error] [pid 14657:tid 14657] [client 34.139.154.138:39320] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "secretsoftheuniverse.bluegrassexpressband.com"] [uri "/.env.save"] [unique_id "apFsIRf8_azl3gEnj7azLAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-08-28 10:58:36
(8 hours ago)
[FriAug2812:58:29.1671192026][security2:error][pid1072945:tid1073211][client34.139.154.138:0]ModSecu ...
show more
[FriAug2812:58:29.1671192026][security2:error][pid1072945:tid1073211][client34.139.154.138:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"r102.ch\"][uri\"/.env.bak\"][unique_id\"apFp1Rd_3ScX6yivrjYgFAAAANA\"]
show less
Hacking
Web App Attack
🇩🇪
pscriptos
2026-08-28 10:48:37
(8 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-08-28 10:28:00
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 06:27:53.491889 2026] [security2:error] [pid 15415:tid 15415] [client 34.139.154.138:39272] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lakewyliehairsalon.com"] [uri "/.env.bak"] [unique_id "apFiqeUycCQuMGj3RsojCgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
cg-design.co.uk
2026-08-28 10:27:39
(9 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.139.154.138 (US/United States/138.15 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.139.154.138 (US/United States/138.154.139.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
aks4226
2026-08-27 22:11:38
(21 hours ago)
Bot search, attacking common web applications.
Web App Attack
🇩🇪
Bedios GmbH
2026-08-27 21:29:44
(22 hours ago)
Login credentials theft attempt
Hacking
🇩🇪
jeannelboutique
2026-08-27 21:19:38
(22 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.139.154.138 (US/United States/138.15 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.139.154.138 (US/United States/138.154.139.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-08-27 19:59:37
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.154.138 (138.154.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 15:59:29.863094 2026] [security2:error] [pid 3460:tid 3460] [client 34.139.154.138:55496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "catholicshopper.com"] [uri "/wp-config.php.bak"] [unique_id "apCXIYVryh2OJeQJj-iI8gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
mediarama.com
2026-08-27 19:59:11
(23 hours ago)
Banned by Fail2Ban
Web App Attack
🇩🇪
big-cloud.nl
2026-08-27 18:32:17
(1 day ago)
Try to access /.env
Web App Attack
🇸🇪
vaia.cloud
2026-08-27 18:30:05
(1 day ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
2026-08-27 17:55:02
(1 day ago)
suspicious request in access.log
Web App Attack