🇧🇷
Caue Henrique
2026-10-23 03:00:01
UTC ·
(3 weeks ago)
Multiple common web attacks, XSS, Web Server 500 Error
Web Spam
Hacking
Web App Attack
🇧🇪
FrankNeirynck
2026-10-21 10:50:11
UTC ·
(3 weeks ago)
94.105.116.65.dyn.edpnet.net 34.171.154.46 - - [21/Oct/2026:12:50:11 +0200] "GET /static//app/.env HTTP/1.1" 404 134 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0;
[email protected] )" 0.000
...
Hacking
Brute-Force
🇳🇱
debestelapp
2026-10-21 04:50:10
UTC ·
(3 weeks ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 04:24:00
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 00:23:53.129063 2026] [security2:error] [pid 27299:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 00:23:53.129063 2026] [security2:error] [pid 27299:tid 27299] [client 34.171.154.46:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.area52designs.com"] [uri "/.htpasswd"] [unique_id "atg-WaYWZOi39J0J9-jR9QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇹
WebTejo
2026-10-21 04:17:38
UTC ·
(3 weeks ago)
Detected multiple authentication failures and invalid user attempts in LF_CPANEL from IP address 34.171.154.46 on [PT] Tucano Node.
Brute-Force
SSH
🇺🇸
TAY
2026-10-21 04:04:08
UTC ·
(3 weeks ago)
34.171.154.46 - - [21/Oct/2026:12:04:05 +0800] "GET /@fs/../.env?raw?? HTTP/1.1" 301 465 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.171.154.46 - - [21/Oct/2026:12:04:06 +0800] "G ...
show more
34.171.154.46 - - [21/Oct/2026:12:04:05 +0800] "GET /@fs/../.env?raw?? HTTP/1.1" 301 465 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.171.154.46 - - [21/Oct/2026:12:04:06 +0800] "GET /@fs/../.env?import&raw?? HTTP/1.1" 301 483 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.171.154.46 - - [21/Oct/2026:12:04:07 +0800] "GET /_nuxt/../.env HTTP/1.1" 301 6296 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)"
34.171.154.46 - - [21/Oct/2026:12:04:07 +0800] "GET /_image?href=/../../../.env HTTP/1.1" 301 493 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.171.154.46 - - [21/Oct/2026:12:04:07 +0800] "GET /webmail?href=/../../../.env HTTP/1.1" 301 6306 "https://webmail.apmconstn.com/_image?href=/../../.
...
show less
Brute-Force
🇳🇱
e.fierstra
2026-10-21 03:54:16
UTC ·
(3 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇩🇪
palzer.IT
2026-10-21 03:50:42
UTC ·
(3 weeks ago)
Report for plesk-apache: [Wed Oct 21 05:50:37.852923 2026] [authz_core:error] [pid 832725:tid 281472392753344] [client 34.171.154.46:0] AH01630: client denied by server configuration: /usr/share/psa-roundcube/config/firebase-admin.json [Wed Oct 21 05 ...
show more
Report for plesk-apache: [Wed Oct 21 05:50:37.852923 2026] [authz_core:error] [pid 832725:tid 281472392753344] [client 34.171.154.46:0] AH01630: client denied by server configuration: /usr/share/psa-roundcube/config/firebase-admin.json [Wed Oct 21 05:50:38.017223 2026] [authz_core:error] [pid 832725:tid 281472825929920] [client 34.171.154.46:0] AH01630: client denied by server configuration: /usr/share/psa-roundcube/config/gcp-credentials.json [Wed Oct 21 05:50:38.478650 2026] [authz_core:error] [pid 834091:tid 281471444775104] [client 34.171.154.46:0] AH01630: client denied by server configuration: /usr/share/psa-roundcube/config/.env
show less
Bad Web Bot
🇹🇷
Jova
2026-10-21 01:02:50
UTC ·
(3 weeks ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇲🇾
Rizzy
2026-10-20 20:47:35
UTC ·
(3 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 20:31:50
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:31:44.433759 2026] [security2:error] [pid 11921:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:31:44.433759 2026] [security2:error] [pid 11921:tid 11921] [client 34.171.154.46:52878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.arogun.org"] [uri "/.env.supabase"] [unique_id "atfPsOhLxR58ixSrnCNYcAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 20:14:55
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:14:48.339665 2026] [security2:error] [pid 14291:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.171.154.46 (46.154.171.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:14:48.339665 2026] [security2:error] [pid 14291:tid 14291] [client 34.171.154.46:39980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.appalachianfolkmagician.com"] [uri "/static../.env"] [unique_id "atfLuENq-MPT6F9aSBjSjwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-10-20 18:49:18
UTC ·
(3 weeks ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
rh24
2026-10-20 18:04:06
UTC ·
(3 weeks ago)
(badbots) Bad bot user-agent [redacted] from 34.171.154.46 (US/United States/46.154.171.34.bc.googleusercontent.com)
Hacking
🇨🇦
alexbfr
2026-10-20 18:01:34
UTC ·
(3 weeks ago)
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-20T18:01:34Z; reported_at=2026-10-20T18:01:35Z
2026-10-20T18:01:34Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T ...
show more
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-20T18:01:34Z; reported_at=2026-10-20T18:01:35Z
2026-10-20T18:01:34Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T18:01:34Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T18:01:35Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T18:01:35Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-10-20T18:01:35Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
show less
Web App Attack
