๐บ๐ธ
TPI-Abuse
2026-10-11 06:55:10
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 02:55:04.649328 2026] [security2:error] [pid 7529:tid 7529] [client 34.151.240.219:33780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.xcengineering.xyz"] [uri "/assets../.env"] [unique_id "assyyOWVW_yYtzQOPUR8rQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-11 06:39:45
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 02:39:38.609351 2026] [security2:error] [pid 18524:tid 18524] [client 34.151.240.219:53042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.aristasol.xyz"] [uri "/uploads../.env"] [unique_id "assvKhcNa7KBqYiHgcn8bQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-10 18:30:45
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 14:30:37.661197 2026] [security2:error] [pid 26321:tid 26321] [client 34.151.240.219:52030] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yourmenu.xyz"] [uri "/.htpasswd"] [unique_id "asqETc9L9RbXJV-svF0MlAAAAGY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
ghostwarriors
2026-10-10 18:20:03
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
๐ฉ๐ช
yitzhaq
2026-10-10 17:50:10
(5 days ago)
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /frontend/.env HTTP/2.0" 404 293 "-" "Mozilla/5 ...
show more
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /frontend/.env HTTP/2.0" 404 293 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /.next/.env HTTP/2.0" 403 296 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /dist/.env HTTP/2.0" 404 293 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /.aws/config HTTP/2.0" 403 296 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /.aws/credentials HTTP/2.0" 404 293 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
34.151.240.219 - - [10/Oct/2026:19:50:03 +0200] "GET /core/.env HTTP/2.0" 404 293 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.151.240.219 -
show less
Web App Attack
Hacking
๐ช๐ธ
robotstxt
2026-10-10 17:45:29
(5 days ago)
34.151.240.219 - - [10/Oct/2026:17:45:08 +0000] "GET /z9x8c7v6b5-debug-trigger-starship.xyz HTTP/2.0 ...
show more
34.151.240.219 - - [10/Oct/2026:17:45:08 +0000] "GET /z9x8c7v6b5-debug-trigger-starship.xyz HTTP/2.0" 403 20 "https://starship.xyz/z9x8c7v6b5-debug-trigger-starship.xyz" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" "-" edge="34.151.240.219"
34.151.240.219 - - [10/Oct/2026:17:45:08 +0000] "GET /build/manifest.json HTTP/2.0" 403 2 "https://starship.xyz/build/manifest.json" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "-" edge="34.151.240.219"
34.151.240.219 - - [10/Oct/2026:17:45:08 +0000] "GET /.vite/manifest.json HTTP/2.0" 403 2 "https://starship.xyz/.vite/manifest.json" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "-" edge="34.151.240.219"
34.151.240.219 - - [10/Oct/2026:17:45:08 +0000] "GET /dist/manifest.json HTTP/2.0" 403 2 "https://starship
...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-10 17:42:26
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:42:19.617651 2026] [security2:error] [pid 1699:tid 1699] [client 34.151.240.219:48696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scottwithers.xyz"] [uri "/.htpasswd"] [unique_id "asp4-9vMrC6LTCvVJ8ZY6AAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-10 17:24:13
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:24:05.969840 2026] [security2:error] [pid 1005:tid 1005] [client 34.151.240.219:60648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kdgsf.xyz"] [uri "/dist../.env"] [unique_id "asp0tSG3kuQrZUH4f-C71QAAAHk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
VirtualAllocEx
2026-10-10 17:10:48
(5 days ago)
Cloudflare automated security report.
Action: BLOCK; events: 49.
Sources: firewallCustom.
Request pa ...
show more
Cloudflare automated security report.
Action: BLOCK; events: 49.
Sources: firewallCustom.
Request paths: /.docker/config.json, /id_rsa, /.ssh/authorized_keys, //.env, /__vite_rsc_findSourceMapURL.
Countries: BR.
ASNs: 396982.
User agents: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] ), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot, Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/), Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler), Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36.
show less
Web App Attack
๐ฉ๐ช
lolyay
2026-10-10 17:09:11
(5 days ago)
34.151.240.219 - - [10/Oct/2026:17:09:09 +0000] "GET /build../.env HTTP/1.1" 200 4 "-" "Mozilla/5.0 ...
show more
34.151.240.219 - - [10/Oct/2026:17:09:09 +0000] "GET /build../.env HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
34.151.240.219 - - [10/Oct/2026:17:09:09 +0000] "GET /img../.env HTTP/1.1" 200 4 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
...
show less
Web App Attack
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-10-10 17:02:45
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.151.240.219 (219.240.151.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:02:38.441209 2026] [security2:error] [pid 31034:tid 31034] [client 34.151.240.219:46986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blogs4sale.xyz"] [uri "/%2e%2e/.env"] [unique_id "aspvrvR8Eznv6NH1plUfDQAAADo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐ธ
antivoid.xyz
2026-10-10 16:57:39
(5 days ago)
Brute-Force
Web App Attack
๐ฉ๐ช
BlueWire Hosting
2026-10-10 16:55:28
(5 days ago)
High-confidence malicious configuration/VCS probe
Web App Attack
๐ฌ๐ง
MrTumnus
2026-10-10 16:36:27
(5 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking