🇷🇸
pexodelic
2026-10-09 03:05:02
(2 days ago)
Automated report from web, SSH and FTP server logs: 168 requests probing for exposed secrets (.env, ...
show more
Automated report from web, SSH and FTP server logs: 168 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-08 19:05 UTC, last reported 2026-10-09 05:05 UTC; counts cover the current log rotation window.
show less
Hacking
Web App Attack
2026-10-09 02:44:09
(2 days ago)
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env?raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 Appl ...
show more
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env?raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )" 34.146.66.77
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env?import&url&inline HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" 34.146.66.77
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env?import&raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.146.66.77
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env.local?raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 34.146.66.77
34.146.66.77 - - [08/Oct/2026:21:44:08 -0500] "GET /.env.local?import&raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)" 34.146.66.77
34.146.66.77 - - [08
...
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-09 02:42:34
(2 days ago)
[ns41.kdns.gr] httpd-config-scan: sites=sostis.gr; samples=/.ssh/id_rsa | /.ssh/id_ed25519 | /@fs/ap ...
show more
[ns41.kdns.gr] httpd-config-scan: sites=sostis.gr; samples=/.ssh/id_rsa | /.ssh/id_ed25519 | /@fs/app/.env
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:19:22
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:19:16.396883 2026] [security2:error] [pid 8310:tid 8310] [client 34.146.66.77:45904] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||snowfection.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "snowfection.com"] [uri "/z9x8c7v6b5-debug-trigger-snowfection.com"] [unique_id "ashPJEC6Ul-xJSb3DH1kjQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-09 02:07:42
(2 days ago)
csagent: score 15.4: 404 noise floor x10, php 404 x2, secrets grab x1; 1 domain(s) in 13s
Web App Attack
🇫🇷
✨
2026-10-09 01:40:09
(2 days ago)
Domain : simonbarnescarpets.co.uk
Rule : hack
2026-10-09 01:39:19 ***hidden-privacy*** GET /.htpassw ...
show more
Domain : simonbarnescarpets.co.uk
Rule : hack
2026-10-09 01:39:19 ***hidden-privacy*** GET /.htpasswd - 443 - 34.146.66.77 HTTP/2 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] ) - simonbarnescarpets.co.uk 301 0 0 531 437 580 - -
show less
Hacking
SQL Injection
Brute-Force
🇺🇸
TPI-Abuse
2026-10-09 01:29:56
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:29:48.879034 2026] [security2:error] [pid 28291:tid 28291] [client 34.146.66.77:48984] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||siczewicz.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "siczewicz.com"] [uri "/z9x8c7v6b5-debug-trigger-siczewicz.com"] [unique_id "ashDjMhh7lApavk7iGpvrAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-09 00:54:38
(3 days ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-09 00:25:23
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:25:15.507330 2026] [security2:error] [pid 10949:tid 10949] [client 34.146.66.77:54852] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||schunagroup.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "schunagroup.com"] [uri "/z9x8c7v6b5-debug-trigger-schunagroup.com"] [unique_id "asg0a5M_nzk8GMUHNEk_RAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 00:08:02
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:07:53.798461 2026] [security2:error] [pid 21636:tid 21636] [client 34.146.66.77:35864] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "satanisdead.com"] [uri "/appearance/../../.env"] [unique_id "asgwWWUT1-brpnxEEOiDHQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-09 00:02:55
(3 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 23:41:09
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:41:04.528491 2026] [security2:error] [pid 25235:tid 25235] [client 34.146.66.77:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sahinozalit.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sahinozalit.com"] [uri "/z9x8c7v6b5-debug-trigger-sahinozalit.com"] [unique_id "asgqEAMVngo6WOsDIBeZAwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 23:24:47
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.146.66.77 (77.66.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:24:39.129416 2026] [security2:error] [pid 11275:tid 11275] [client 34.146.66.77:55672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rums-of-the-world.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rums-of-the-world.com"] [uri "/z9x8c7v6b5-debug-trigger-rums-of-the-world.com"] [unique_id "asgmN_Wfy8CyJf6Hjp6QgwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-08 23:13:43
(3 days ago)
34.146.66.77 - - [09/Oct/2026:02:13:41 +0300] "GET /__vite_rsc_findSourceMapURL?filename=file:///roo ...
show more
34.146.66.77 - - [09/Oct/2026:02:13:41 +0300] "GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/2.0" 403 207 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
34.146.66.77 - - [09/Oct/2026:02:13:42 +0300] "GET /config.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇪🇸
pipeline.es
2026-10-08 23:05:21
(3 days ago)
Web scanning / probing for vulnerable paths | URL: /.git-credentials | Evidence: rondatur.pt 34.146. ...
show more
Web scanning / probing for vulnerable paths | URL: /.git-credentials | Evidence: rondatur.pt 34.146.66.77 - - [09/Oct/2026:01:05:05 +0200] \"GET /.git-credentials HTTP/2.0\" 404 21027 \"-\" \"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)\" GEOIP_COUNTRY_CODE=JP 17619 | ASN: GOOGLE-CLOUD-PLATFORM | Country: JP
show less
Port Scan
Web App Attack
