2026-10-11 09:32:49
(6 days ago)
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla ...
show more
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 172.70.38.197
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env.example HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 172.68.138.239
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 172.68.138.239
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env.backup HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)" 172.68.138.239
34.182.247.204 - - [11/Oct/2026:04:31:59 -0500] "GET /.env HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0;
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
dalslab ltd
2026-10-11 07:49:36
(6 days ago)
2026/10/11 09:49:35 [error] 336#336: *582328 limiting requests, excess: 200.040 by zone "rl_per_ip", ...
show more
2026/10/11 09:49:35 [error] 336#336: *582328 limiting requests, excess: 200.040 by zone "rl_per_ip", client: 34.182.247.204, server: auth.dalslab.com, request: "GET /static/home/user/.env HTTP/2.0", host: "auth.dalslab.com", referrer: "https://auth.dalslab.com/static//home/user/.env"
2026/10/11 09:49:35 [error] 336#336: *582328 limiting requests, excess: 200.030 by zone "rl_per_ip", client: 34.182.247.204, server: auth.dalslab.com, request: "GET /css../.env HTTP/2.0", host: "auth.dalslab.com"
2026/10/11 09:49:35 [error] 336#336: *582328 limiting requests, excess: 200.690 by zone "rl_per_ip", client: 34.182.247.204, server: auth.dalslab.com, request: "GET /api/.env/public/.env HTTP/2.0", host: "auth.dalslab.com"
2026/10/11 09:49:35 [error] 336#336: *582328 limiting requests, excess: 200.640 by zone "rl_per_ip", client: 34.182.247.204, server: auth.dalslab.com, request: "GET /static//app/.env HTTP/2.0", host: "auth.dalslab.com"
2026/10/11 09:49:35 [error] 336#336: *582328 limiting reques
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-11 03:30:47
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:30:40.614137 2026] [security2:error] [pid 8330:tid 8330] [client 34.182.247.204:33378] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||agroeurocommodities.com.asiancommoditiescorporation.com|F|2"] [data ".com.asiancommoditiescorporation.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "agroeurocommodities.com.asiancommoditiescorporation.com"] [uri "/z9x8c7v6b5-debug-trigger-agroeurocommodities.com.asiancommoditiescorporation.com"] [unique_id "assC4Ld97OTUJ5HyEXNpqgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-11 03:27:00
(6 days ago)
XSS Attempt
Hacking
🇫🇷
security.rdmc.fr
2026-10-11 01:41:06
(6 days ago)
Sensitive File Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:30:55
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:30:50.970481 2026] [security2:error] [pid 7460:tid 7460] [client 34.182.247.204:57656] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ae5cp.kreweofhyatt.com|F|2"] [data ".kreweofhyatt.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ae5cp.kreweofhyatt.com"] [uri "/z9x8c7v6b5-debug-trigger-ae5cp.kreweofhyatt.com"] [unique_id "asrmymRHqIE9ysus0z97ZAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-10-11 01:01:35
(6 days ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
2026-10-11 00:40:06
(6 days ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
ipblock.com
2026-10-11 00:29:00
(6 days ago)
IPBlock protected site ID [4055-d][s=01].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 00:14:21
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 20:14:13.955756 2026] [security2:error] [pid 26286:tid 26286] [client 34.182.247.204:43898] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vabq.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vabq.com"] [uri "/z9x8c7v6b5-debug-trigger-vabq.com"] [unique_id "asrU1XZ7BHBhDbmRPsFimwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-10-11 00:10:32
(6 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-10 23:50:10
(6 days ago)
20 attempts against mh-misbehave-ban on burne
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 23:43:47
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 19:43:39.888608 2026] [security2:error] [pid 6092:tid 6094] [client 34.182.247.204:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||raytbrown.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "raytbrown.com"] [uri "/z9x8c7v6b5-debug-trigger-raytbrown.com"] [unique_id "asrNq5bIjnFb-xGscej1QQAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
mravb
2026-10-10 23:19:39
(6 days ago)
34.182.247.204 - - [11/Oct/2026:02:19:38 +0300] "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0" 44 ...
show more
34.182.247.204 - - [11/Oct/2026:02:19:38 +0300] "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
...
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-10 22:41:30
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.247.204 (204.247.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 18:41:24.010323 2026] [security2:error] [pid 2464:tid 2464] [client 34.182.247.204:41444] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grupoporvenir.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grupoporvenir.com"] [uri "/z9x8c7v6b5-debug-trigger-grupoporvenir.com"] [unique_id "asq_FFIhByPgptfWuG-VPwAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack