🇨🇭
backslash
2026-06-15 07:36:00
(12 hours ago)
block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-15 04:23:03
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:22:57.845584 2026] [security2:error] [pid 11924:tid 11924] [client 34.140.91.117:41048] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.nutchild.com"] [uri "/.env.dev.local"] [unique_id "ai9-IepFuBasDxp2nzhalgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 03:17:11
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 23:17:07.756334 2026] [security2:error] [pid 30612:tid 30612] [client 34.140.91.117:41224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armorcorp.com"] [uri "/.env.dev.local"] [unique_id "ai9us38M-AE8Y86LXwKV4QAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-15 01:37:59
(18 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-06-15 01:24:13
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:24:05.868976 2026] [security2:error] [pid 7421:tid 7421] [client 34.140.91.117:32916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lipingdata.com"] [uri "/.env.sample"] [unique_id "ai9UNYAcyBIFX2hWBeeKfwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:39:28
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.140.91.117 (117.91.140.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:39:23.227614 2026] [security2:error] [pid 1996:tid 1996] [client 34.140.91.117:48836] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ask2023.com.whatifandwhynot.xyz"] [uri "/.env.production"] [unique_id "ai87q9A_1EV_WK6gOwklQwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-06-14 23:00:43
(21 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-probing.
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-14 22:20:55
(21 hours ago)
{"level":"info","ts":1781475653.6782608,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781475653.6782608,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.140.91.117","remote_port":"34318","client_ip":"34.140.91.117","proto":"HTTP/1.1","method":"GET","host":"status.banorteusa.com","uri":"/.env.stage","headers":{"User-Agent":["Mozilla/5.0 (Linux; Android 9; VOG-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.banorteusa.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.000114569,"size":0,"status":429,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"],"Server":["Caddy"]}}
{"level":"info","ts":1781475653.6800988,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.140.91.117","remote_port":"34234","client_ip":"34.140.91.117","proto":"HTTP/1.1","method":"G
...
show less
DDoS Attack
Web App Attack
🇳🇱
homeshowdomain.nl
2026-06-14 22:03:41
(22 hours ago)
Auto-ban: >3000 req/min op 2026-06-14
Web App Attack
SSH
Hacking
2026-06-14 17:22:31
(1 day ago)
fail2ban:piguard2:18,19,21
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-14 15:07:30
(1 day ago)
20 attempts against mh-misbehave-ban on guava
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-14 07:40:13
(1 day ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
mnsf
2026-06-14 07:05:15
(1 day ago)
Abuse Detected (34)
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-06-14 06:51:50
(1 day ago)
117 requests with url.path *sendgrid.env
Brute-Force
Bad Web Bot
🇮🇹
VHosting
2026-06-14 03:15:04
(1 day ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack