🇫🇷
900cm
2026-06-15 13:01:35
(2 days ago)
[Mon Jun 15 15:01:32.903126 2026] [access_compat:error] [pid 4041192:tid 4041192] [client 34.176.27. ...
show more
[Mon Jun 15 15:01:32.903126 2026] [access_compat:error] [pid 4041192:tid 4041192] [client 34.176.27.45:53026] AH01797: client denied by server configuration: /var/www/darkintruder/.azure
[Mon Jun 15 15:01:34.145633 2026] [access_compat:error] [pid 4041348:tid 4041348] [client 34.176.27.45:53274] AH01797: client denied by server configuration: /var/www/darkintruder/.gcloud
[Mon Jun 15 15:01:34.502020 2026] [access_compat:error] [pid 4089631:tid 4089631] [client 34.176.27.45:53360] AH01797: client denied by server configuration: /var/www/darkintruder/.aws
...
show less
Port Scan
Brute-Force
SSH
🇳🇱
Savvii
2026-06-15 10:54:31
(2 days ago)
20 attempts against mh_ha-misbehave-ban on ceres
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 09:08:55
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:08:47.516560 2026] [security2:error] [pid 28818:tid 28835] [client 34.176.27.45:45952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cas.bestofthis.com"] [uri "/.env.production.bak"] [unique_id "ai_BH8RIphRj0RdOLyUpKAAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-06-15 08:12:57
(2 days ago)
IM360 WAF: Direct access to sensitive file or dotfile MV:/api/.env.staging
Web App Attack
2026-06-15 05:51:12
(2 days ago)
Bot / seems abusive / Apache connections: 117
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 04:41:58
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:41:51.234107 2026] [security2:error] [pid 8929:tid 8929] [client 34.176.27.45:46864] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.helloauto.net.hellomdinc.com"] [uri "/.env.stage"] [unique_id "ai-Cj5yxJtkXvyZIm8ZNZQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-15 04:35:39
(2 days ago)
Excessive multi-domain requests
Brute-Force
🇬🇷
setupgr
2026-06-15 03:51:06
(2 days ago)
(mod_security) mod_security (id:11000011) triggered by 34.176.27.45: 1 in the last 86400 secs; Ports ...
show more
(mod_security) mod_security (id:11000011) triggered by 34.176.27.45: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Jun 15 06:51:02.752454 2026] [security2:error] [pid 948989:tid 949017] [client 34.176.27.45:41012] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "128"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 45.27.176.34.bc.googleusercontent.com"] [hostname "www.ftiaxtomonosou.gr"] [uri "/.env.bak"] [unique_id "ai92ptXD3_cY7WcDuxq-lwAAAIE"]
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-15 03:17:06
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 23:16:59.364788 2026] [security2:error] [pid 30463:tid 30463] [client 34.176.27.45:37322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "survey.joebankx.com"] [uri "/api/.env.local"] [unique_id "ai9uqxFpVQJ4n07dvlT_UQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 02:50:49
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:949110) triggered by 34.176.27.45 (45.27.176.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 22:50:43.506565 2026] [security2:error] [pid 6598:tid 6598] [client 34.176.27.45:46326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ohp.freedrm.org"] [uri "/.env.backup.txt"] [unique_id "ai9og7HFVRgNSixJ0VQ0RQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-06-15 02:05:28
(2 days ago)
Abuse Detected (17)
Brute-Force
Web App Attack
🇩🇪
grassau.com
2026-06-14 23:49:10
(3 days ago)
*Port Scan* detected from 34.176.27.45 (CL/Chile/Santiago Metropolitan/Santiago/45.27.176.34.bc.goog ...
show more
*Port Scan* detected from 34.176.27.45 (CL/Chile/Santiago Metropolitan/Santiago/45.27.176.34.bc.googleusercontent.com).
show less
Port Scan
🇳🇱
Cloud86 B.V.
2026-06-14 23:39:02
(3 days ago)
categories: DDoS Attack
DDoS Attack
🇫🇷
Octopuce
2026-06-14 23:05:48
(3 days ago)
Aggressive web search of vulnerable pages: /test/.env /.env.local /uat/.env /qa/.env /dev/.env ...
Web App Attack
🇩🇪
psauxit
2026-06-14 06:30:15
(3 days ago)
Fail2Ban - NGINX heavily bad-bot, possible vulnerability scanning and excessive crawling/scraping
Bad Web Bot
Web App Attack
Hacking
Web Spam