🇧🇷
Black_Brazil
2026-08-26 21:12:00
(6 days ago)
The IPwas observed executing high-frequency probes against web assets, generating hundreds of blocke ...
show more
The IPwas observed executing high-frequency probes against web assets, generating hundreds of blocked requests targeting sensitive configuration files, environment keys, cloud credentials, database backups, and framework debugging endpoints.
## Telemetry Summary
- ** IP Address: 34.177.86.81
- **Total Requests Observed:** 554 requests
- ** Date: 2026-08-26; Time: 14:07:19 BRT;
- **Mitigation Vectors:** Blocked dynamically across Cloudflare Custom Rules, Managed Rules, and "I'm Under Attack Mode" settings.
## Sampled Attack Paths & Signatures
The actor systematically probed for exposed system files and secrets, including:
- **Cloud & Infrastructure Credentials:** AWS credentials paths (`/.aws/credentials`, `aws/metadata/...`), GCP service accounts (`gcp-key.json`, `firebase-admin.json`), Azure and Kubernetes config files (`/.kube/config`, `/.azure/accessTokens.json`).
- **Environment & Configuration Files:** Multiple iterations of `.env` files, `wp-config.php` backups,
show less
Bad Web Bot
Web App Attack
Hacking
2026-08-26 17:57:12
(6 days ago)
Bot / seems abusive / Apache connections: 39
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-08-26 17:45:02
(6 days ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-08-26 17:20:15
(6 days ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
mediarama.com
2026-08-26 14:33:34
(6 days ago)
Banned by Fail2Ban
Web App Attack
🇪🇸
alferez
2026-08-26 14:17:51
(6 days ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 13:25:11
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 09:25:06.878198 2026] [security2:error] [pid 32038:tid 32060] [client 34.177.86.81:36580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.titaniumclover.com"] [uri "/static../.env"] [unique_id "ao7pMnUwG2A5dkgyDXdD0QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-08-26 12:27:47
(6 days ago)
*Port Scan* detected from 34.177.86.81 (SG/Singapore/-/Singapore/81.86.177.34.bc.googleusercontent.c ...
show more
*Port Scan* detected from 34.177.86.81 (SG/Singapore/-/Singapore/81.86.177.34.bc.googleusercontent.com/[redacted]).
show less
Port Scan
🇺🇸
TPI-Abuse
2026-08-26 12:09:10
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 08:09:02.680079 2026] [security2:error] [pid 14887:tid 14887] [client 34.177.86.81:55136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weddingsuppliescanada.com"] [uri "/.env"] [unique_id "ao7XXswLCA8Lf7z4EBn99gAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-26 09:27:14
(6 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
4server
2026-08-26 08:51:17
(6 days ago)
[WedAug2610:51:11.0013532026][security2:error][pid3707255:tid3707306][client34.177.86.81:0]ModSecuri ...
show more
[WedAug2610:51:11.0013532026][security2:error][pid3707255:tid3707306][client34.177.86.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"/etc/passwd\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"141\"][id\"347009\"][rev\"1\"][msg\"Atomicorp.comWAFRules:ProtectedFileaccessdenied\"][severity\"CRITICAL\"][hostname\"prstartup.ch\"][uri\"/static../etc/passwd\"][unique_id\"ao6o_wgYqT2moLZhbGAq3wAAAE4\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-08-26 08:41:31
(6 days ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇸🇪
vaia.cloud
2026-08-26 08:40:02
(6 days ago)
crowdsecurity/http-wordpress_wpconfig
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 08:11:35
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.177.86.81 (81.86.177.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 04:11:26.124601 2026] [security2:error] [pid 30810:tid 30810] [client 34.177.86.81:36474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oss-in-atm.info"] [uri "/media../.env"] [unique_id "ao6frmPc6mvaX8MOjahEWwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-08-26 07:05:21
(6 days ago)
Scanning/Probing (12)
Brute-Force
Web App Attack