🇺🇸
TPI-Abuse
2026-09-04 14:50:38
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:50:31.689520 2026] [security2:error] [pid 14316:tid 14316] [client 34.159.148.38:34130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrischamberlain.com"] [uri "/.env.local"] [unique_id "apratx2PQhCkWglb84w8iwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:08:04
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:07:57.396630 2026] [security2:error] [pid 5855:tid 5855] [client 34.159.148.38:33306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.holtzheimer.net"] [uri "/.env"] [unique_id "aprQvWxQkFoTbdDfppBzFQAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
tmiland
2026-09-04 14:05:03
(18 hours ago)
(nginx_404) Dot directory Honeypot Trap 34.159.148.38 (DE/Germany/38.148.159.34.bc.googleusercontent ...
show more
(nginx_404) Dot directory Honeypot Trap 34.159.148.38 (DE/Germany/38.148.159.34.bc.googleusercontent.com): 2 in the last 3600 secs; IP: 34.159.148.38; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.159.148.38 - - [04/Sep/2026:16:04:58 +0200] "GET /.env.local HTTP/1.1" 404 1890 "-" "crusader-worker/1.0" 34.159.148.38 - - [04/Sep/2026:16:04:58 +0200] "GET /.env HTTP/1.1" 404 1890 "-" "crusader-worker/1.0"
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-04 13:52:00
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:51:52.428874 2026] [security2:error] [pid 1658:tid 1658] [client 34.159.148.38:47804] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advmach.com"] [uri "/.env.production"] [unique_id "aprM-IDvV34C0JAaJ_3THQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:00:22
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:00:16.368945 2026] [security2:error] [pid 11019:tid 11019] [client 34.159.148.38:39266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "server1.davisllp.com"] [uri "/.env.example"] [unique_id "aprA4B__S_Xffy8gZ5D_xwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
COMAITE
2026-09-04 12:54:43
(19 hours ago)
Suspicious URL access.
Web App Attack
2026-09-04 12:35:46
(20 hours ago)
Bloqueado automaticamente por CrowdSec escenario crowdsecurity/http-sensitive-files
Brute-Force
🇬🇧
Aetherweb Ark
2026-09-04 12:31:43
(20 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.159.148.38 (DE/Germany/38.148.159.34.bc.goog ...
show more
(mod_security) mod_security (id:949110) triggered by 34.159.148.38 (DE/Germany/38.148.159.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:52:59
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:52:53.896557 2026] [security2:error] [pid 29726:tid 29726] [client 34.159.148.38:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail-pmg.com"] [uri "/.env.prod"] [unique_id "apqxFfI34FBvTtnOP1ep4QAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-04 10:14:33
(22 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:06:51
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:06:46.410507 2026] [security2:error] [pid 16108:tid 16108] [client 34.159.148.38:56858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.kathleenhazlett.com"] [uri "/.env.dev"] [unique_id "apqYNr8fygebGUqxp5W9uAAAAC4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-04 08:45:14
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-04 08:23:40
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-04 08:22:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.148.38 (38.148.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:22:43.716275 2026] [security2:error] [pid 24469:tid 24469] [client 34.159.148.38:45100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.dymesich.com"] [uri "/.env.local"] [unique_id "app_05jkVbVHLJ88-gZZdQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-09-04 08:21:14
(1 day ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.159.148.38 (DE/Germany/38.148.159.34. ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.159.148.38 (DE/Germany/38.148.159.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.159.148.38 - - [04/Sep/2026:10:21:11 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 146 "-" "crusader-worker/1.0" "-" host=mail.italpmiabruzzo.it
show less
Port Scan
