🇺🇸
TPI-Abuse
2026-11-05 12:48:02
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:47:55.391027 2026] [security2:error] [pid 7486:tid 7486] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 07:47:55.391027 2026] [security2:error] [pid 7486:tid 7486] [client 34.152.7.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.poweribo.com"] [uri "/.env.secret"] [unique_id "aux6-z3tg8mwqpKnRRbrCQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
chronos
2026-11-05 11:58:21
UTC ·
(1 week ago)
[AUTORAVALT][[05/11/2026 - 08:58:20 -03:00 UTC]
Attack from [Google LLC]
[34.152.7.94][94.7.152.34.bc.googleusercontent.com]
Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email.
...
show more
[AUTORAVALT][[05/11/2026 - 08:58:20 -03:00 UTC]
Attack from [Google LLC]
[34.152.7.94][94.7.152.34.bc.googleusercontent.com]
Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email.
Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam.
Blog Spam -> CMS blog comment spam.
Web App]
...
show less
DDoS Attack
Phishing
Web Spam
Blog Spam
Web App Attack
🇿🇦
conure.sh
2026-11-05 10:22:17
UTC ·
(1 week ago)
csagent: score 21.3: 404 noise floor x6, spoofed crawler UA x1, secrets grab x1; 2 domain(s) in 4s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 09:56:25
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:56:19.196662 2026] [security2:error] [pid 25713:tid 2571 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:56:19.196662 2026] [security2:error] [pid 25713:tid 25713] [client 34.152.7.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webfrog.ws"] [uri "/api/console/api_server"] [unique_id "auxSw5awjmTDOFcpJ0rGVQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 08:33:34
UTC ·
(1 week ago)
[da.kdns.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/apps/api/.env | /process.env | /apps/dashboard/.env
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:01:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:00:56.120851 2026] [security2:error] [pid 28293:tid 2829 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:00:56.120851 2026] [security2:error] [pid 28293:tid 28293] [client 34.152.7.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.cloudex.click"] [uri "/apps/dashboard/.env"] [unique_id "auwpqJad6C00JZ9zPxWTWQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-05 06:20:06
UTC ·
(1 week ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.152.7.94 - - [05/Nov/2026:07:19:49 +0100] "GET /build../.env HTTP/1.1" 403 519 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@byted ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.152.7.94 - - [05/Nov/2026:07:19:49 +0100] "GET /build../.env HTTP/1.1" 403 519 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-11-05 05:36:26
UTC ·
(1 week ago)
[redacted] 34.152.7.94 - - [05/Nov/2026:06:36:23 +0100] "GET /uploads../.env HTTP/2.0" 301 78 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@[redacted])" [redacted] 34.152.7.94 - - [05/Nov/2026:06:36:23 ...
show more
[redacted] 34.152.7.94 - - [05/Nov/2026:06:36:23 +0100] "GET /uploads../.env HTTP/2.0" 301 78 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@[redacted])" [redacted] 34.152.7.94 - - [05/Nov/2026:06:36:23 +0100] "GET /laravel../.env HTTP/2.0" 301 55 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://[redacted]/adsbot"
show less
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-11-05 05:30:59
UTC ·
(1 week ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-05 05:30 UTC.
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-11-05 05:28:40
UTC ·
(1 week ago)
(PERMBLOCK) 34.152.7.94 (CA/Canada/94.7.152.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
Port Scan
2026-11-05 05:24:31
UTC ·
(1 week ago)
[ns41.kdns.gr] httpd-config-scan: sites=www.medisto.gr; logs=/var/log/httpd/domains/medisto.gr.log; samples=/.env.keys | /.env.production.local | /.env.supabase
Hacking
Web App Attack
2026-11-05 04:59:19
UTC ·
(1 week ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇨🇦
CentiDevOps
2026-11-05 04:49:26
UTC ·
(1 week ago)
Web app scan: 596 requests in 13 s across 3 domains (301/302/404). Paths: /.git/config, /assets../.env, /build../.env (+60 more). Sample: 2026-11-05T04:49:26Z "GET /css../.env" 301
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 04:20:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:20:54.107938 2026] [security2:error] [pid 26530:tid 2653 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:20:54.107938 2026] [security2:error] [pid 26530:tid 26530] [client 34.152.7.94:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||caspina.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "caspina.com"] [uri "/z9x8c7v6b5-debug-trigger-caspina.com"] [unique_id "auwEJm27s2JCqdqdWwNCcgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 02:53:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:53:49.624001 2026] [security2:error] [pid 4891:tid 4891] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.152.7.94 (94.7.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:53:49.624001 2026] [security2:error] [pid 4891:tid 4891] [client 34.152.7.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.barryherbach.com"] [uri "/.env.supabase"] [unique_id "auvvvelhX0IohRHnvsX5XQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
