🇱🇻
garmtech.com
2026-09-01 11:10:17
(9 hours ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 11:01:32
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:01:24.598597 2026] [security2:error] [pid 7226:tid 7226] [client 34.180.4.31:59766] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.lynnsmetkodesigns.com"] [uri "/.env.local"] [unique_id "apawhM-t4XQQz4ujdorLugAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-01 10:23:32
(10 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-09-01 09:45:51
(11 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.180.4.31 (IN/India/31.4.180.34.bc.googleuser ...
show more
(mod_security) mod_security (id:949110) triggered by 34.180.4.31 (IN/India/31.4.180.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇳🇴
jad-abuse
2026-09-01 09:44:37
(11 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, scanner_ua, actuator, source_backup, config_backup, ignition_debug. Observed by 1 sensor(s); 26 hits.
show less
Hacking
Web App Attack
🇷🇴
clauss
2026-09-01 09:24:18
(11 hours ago)
34.180.4.31 - - [01/Sep/2026:12:24:17 +0300] "GET /actuator/configprops HTTP/2.0" 401 543 "-" "crusa ...
show more
34.180.4.31 - - [01/Sep/2026:12:24:17 +0300] "GET /actuator/configprops HTTP/2.0" 401 543 "-" "crusader-worker/1.0"
34.180.4.31 - - [01/Sep/2026:12:24:17 +0300] "GET /_ignition/health-check HTTP/2.0" 401 543 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇳🇱
e.fierstra
2026-09-01 07:48:45
(12 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-09-01 06:30:04
(14 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 03:51:27
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:51:22.143462 2026] [security2:error] [pid 22374:tid 22374] [client 34.180.4.31:54626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "allseniorsolutions.com"] [uri "/.env.prod"] [unique_id "apZLumymRjXRNOol63ubYgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
YF
2026-09-01 03:31:20
(17 hours ago)
WordPress config file probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 03:05:43
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:05:38.164002 2026] [security2:error] [pid 7438:tid 7438] [client 34.180.4.31:39594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "p-co.com"] [uri "/.env.bak"] [unique_id "apZBAl9FOLZ58iksIFQtWQAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 01:38:41
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:38:36.557338 2026] [security2:error] [pid 13771:tid 13771] [client 34.180.4.31:32974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psychoatomicpower.theknowledgemaster.com"] [uri "/.env.old"] [unique_id "apYsnFf7ra1yTyQ6HAhfCwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-09-01 01:20:26
(19 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇵🇱
Budyn
2026-09-01 01:19:26
(19 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dock.budyn.wtf | URI: /.env.bak | UA: crusader-worker/1.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 01:15:49
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.180.4.31 (31.4.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:15:41.463047 2026] [security2:error] [pid 14217:tid 14217] [client 34.180.4.31:57208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "discountbusinessholidaycards.com"] [uri "/.env.backup"] [unique_id "apYnPdeqIKyqhEdpS3OFmQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack