🇫🇷
SpaceHost-Server
2026-09-01 22:21:26
(4 hours ago)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-01 22:00:17
(4 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-31.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-01 13:51:36
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:51:33.020640 2026] [security2:error] [pid 12947:tid 12947] [client 34.147.190.208:38918] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.handcraftedparquet.com"] [uri "/.env.dev"] [unique_id "apbYZQzFZXdGt6QJ5oM3nAAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇪
AutosOnShow
2026-09-01 13:34:05
(13 hours ago)
blocked for webapp attack | path requested: /.env | seen at 2026-09-01 13:33:49.198 |
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 12:46:36
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:46:32.137808 2026] [security2:error] [pid 22241:tid 22353] [client 34.147.190.208:42990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "castaspell.com"] [uri "/wp-config.php.bak"] [unique_id "apbJKGXeETkt3gyVFH9F8AAAANE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 12:00:05
(14 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 11:24:02
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:23:58.152901 2026] [security2:error] [pid 20012:tid 20012] [client 34.147.190.208:33634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.whatcausesmentalillness.com"] [uri "/.env"] [unique_id "apa1zhN5yvqynOW1yxR3uAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-09-01 11:06:14
(15 hours ago)
Attempted access to sensitive endpoint (/.env.save) detected. Automated scan or unauthorized probing ...
show more
Attempted access to sensitive endpoint (/.env.save) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 11:03:08
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:03:03.404019 2026] [security2:error] [pid 29323:tid 29571] [client 34.147.190.208:36566] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.quetzalcoatl2012.net"] [uri "/.env.prod"] [unique_id "apaw54L9jUd1Jc6zHxsAlwAAAMQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 10:18:52
(16 hours ago)
[server.tmg.gr] httpd-config-scan: sites=www.aidshep2018.gr; logs=/var/log/httpd/domains/aidshep2018 ...
show more
[server.tmg.gr] httpd-config-scan: sites=www.aidshep2018.gr; logs=/var/log/httpd/domains/aidshep2018.gr.log; samples=/.env.prod | /.env | /wp-config.php.swp
show less
Hacking
Web App Attack
2026-09-01 10:07:05
(16 hours ago)
Automated web scanner. Requested suspicious paths: /.env.bak. UTC: 2026-09-01 09:20:06.
Web App Attack
🇩🇪
macrob
2026-09-01 10:03:00
(16 hours ago)
2026/09/01 10:02:59 [error] 2296396#2296396: *543885378 access forbidden by rule, client: 34.147.190 ...
show more
2026/09/01 10:02:59 [error] 2296396#2296396: *543885378 access forbidden by rule, client: 34.147.190.208, server: finami.ph, request: "GET /.env.old HTTP/2.0", host: "finami.ph"
2026/09/01 10:02:59 [error] 2296399#2296399: *543865685 access forbidden by rule, client: 34.147.190.208, server: finami.ph, request: "GET /.env.prod HTTP/2.0", host: "finami.ph"
2026/09/01 10:02:59 [error] 2296398#2296398: *543870264 access forbidden by rule, client: 34.147.190.208, server: finami.ph, request: "GET /.env.example HTTP/2.0", host: "finami.ph"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 09:59:29
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (208.190.147.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:59:20.874885 2026] [security2:error] [pid 4871:tid 4871] [client 34.147.190.208:36974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "frankcgill.com"] [uri "/.env.save"] [unique_id "apah-E0cItLklcKADTcUxAAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
SysAdmin Dylan
2026-09-01 09:51:19
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (GB/United Kingdom/208.190.147.3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.147.190.208 (GB/United Kingdom/208.190.147.34.bc.googleusercontent.com): 10 in the last 3600 secs
show less
Brute-Force
🇫🇷
masterguru
2026-09-01 09:41:17
(16 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-201)
show less
Hacking