🇳🇱
homeshowdomain.nl
2026-06-10 22:01:10
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-09.
show less
Web App Attack
SSH
Hacking
🇳🇱
debestelapp
2026-06-10 00:30:07
(1 week ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 23:07:00
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 19:06:55.264502 2026] [security2:error] [pid 4504:tid 4504] [client 34.16.162.100:45584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "awl-v.com"] [uri "/.env.prod.bak"] [unique_id "aiicj8A63MlRRWSTl44YiQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 22:35:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:35:10.559113 2026] [security2:error] [pid 14839:tid 14839] [client 34.16.162.100:57144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thetheaterathollywoodandvine.com"] [uri "/api/.env.old"] [unique_id "aiiVHtWf9NGMo1Y2VIsCZQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-09 21:10:04
(1 week ago)
{"level":"info","ts":1781039403.462881,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1781039403.462881,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.16.162.100","remote_port":"52046","client_ip":"34.16.162.100","proto":"HTTP/1.1","method":"GET","host":"update.onmponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.save","headers":{"Connection":["close"],"User-Agent":["Mozilla/5.0 (Linux; U; Android 8.1.0; en-US; Infinix X624B Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.13.0.1207 Mobile Safari/537.36"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"]}},"bytes_read":0,"user_id":"","duration":0.000285846,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://update.onmponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.env.save"],"Content-Type":[]}}
{"level":"info","ts":1781039403.5726264,"logger":"http.log.access.log1","msg":"handled request","r
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 12:17:56
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 08:17:50.037316 2026] [security2:error] [pid 17283:tid 17283] [client 34.16.162.100:36374] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.carlfink.cafink.name"] [uri "/.env.staging"] [unique_id "aigEbuYN3H0X7RVcAQ1wHgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 12:02:42
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 08:02:36.826609 2026] [security2:error] [pid 24651:tid 24651] [client 34.16.162.100:34308] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "susanleeward.com"] [uri "/.env.test"] [unique_id "aigA3IWSooqmTyotLyhnGwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-06-09 11:29:02
(1 week ago)
trying wp-login.php/xmlrpc.php 144 times in 1 minutes
Brute-Force
Web App Attack
2026-06-09 09:40:39
(1 week ago)
(caddyscan) Scanner path probe from 34.16.162.100 (US/United States/100.162.16.34.bc.googleuserconte ...
show more
(caddyscan) Scanner path probe from 34.16.162.100 (US/United States/100.162.16.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.16.162.100 - - [09/Jun/2026:09:40:38 +0000] "GET /.env.txt HTTP/1.1"
[REDACTED] 200 2627 34.16.162.100 - - [09/Jun/2026:09:40:38 +0000] "GET /.env.stage HTTP/1.1"
[REDACTED] 200 2627 34.16.162.100 - - [09/Jun/2026:09:40:38 +0000] "GET /.env.example HTTP/1.1"
[REDACTED] 200 2627 34.16.162.100 - - [09/Jun/2026:09:40:38 +0000] "GET /.env.qa HTTP/1.1"
[REDACTED] 200 2627 34.16.162.100 - - [09/Jun/2026:09:40:38 +0000] "GET /.env.production.local HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-09 07:02:19
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 03:02:14.397466 2026] [security2:error] [pid 27353:tid 27353] [client 34.16.162.100:38796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lanuevaley.com.labelrecord.com"] [uri "/.env.prod"] [unique_id "aie6dohXAHviTB95pZqgNwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Cloud86 B.V.
2026-06-09 07:00:08
(1 week ago)
categories: DDoS Attack
DDoS Attack
🇺🇸
TPI-Abuse
2026-06-09 03:23:07
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 23:23:01.284913 2026] [security2:error] [pid 13620:tid 13620] [client 34.16.162.100:34748] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "documents.progressivefileshare.org"] [uri "/.env.dev"] [unique_id "aieHFce_iqEaeQg5XdJy8gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-09 01:24:30
(1 week ago)
34.16.162.100 - - [09/Jun/2026:04:24:28 +0300] "GET /.env HTTP/1.1" 404 3291 "-" "Mozilla/5.0 (Macin ...
show more
34.16.162.100 - - [09/Jun/2026:04:24:28 +0300] "GET /.env HTTP/1.1" 404 3291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
34.16.162.100 - - [09/Jun/2026:04:24:29 +0300] "GET /app/backend/.env HTTP/1.1" 404 3290 "-" "EmailWolf 1.00"
...
show less
Web App Attack
🇺🇸
mnsf
2026-06-09 00:19:50
(1 week ago)
Scanning/Probing (51)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 22:15:26
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.16.162.100 (100.162.16.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 18:15:18.403568 2026] [security2:error] [pid 30339:tid 30339] [client 34.16.162.100:35756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lightedpath.com"] [uri "/.env.preprod"] [unique_id "aic-9g4LoUpG8W5pnbCIoQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack