🇮🇩
bps-statistics
2026-09-06 03:49:52
UTC ·
(2 months ago)
Web Application Attacks
Web App Attack
🇩🇪
tsZero
2026-09-06 02:36:54
UTC ·
(2 months ago)
Scan example: path=/.env.backup status=404
Hacking
🇩🇪
4server
2026-09-06 02:29:11
UTC ·
(2 months ago)
[SunSep0604:29:08.2389602026][security2:error][pid2317564:tid2317684][client34.185.79.63:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BL ...
show more
[SunSep0604:29:08.2389602026][security2:error][pid2317564:tid2317684][client34.185.79.63:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"sisuconsulting.net\"][uri\"/.env.example\"][unique_id\"apzP9L2gu0kRMJB0E4qb5wAAAQk\"]
show less
Port Scan
Brute-Force
Web App Attack
2026-09-06 02:25:03
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /actuator/env HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.bak HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /env HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /.env.producti ...
show more
Bot / scanning and/or hacking attempts: GET /actuator/env HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.bak HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /env HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.local HTTP/1.1, GET /wp-config.php.swp HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-09-06 01:21:04
UTC ·
(2 months ago)
[Sat Sep 05 19:21:04.198347 2026] [authz_core:error] [pid 26875:tid 139766263694912] [client 34.185.79.63:36840] AH01630: client denied by server configuration: /var/www/public_html/symposium/wp-config.php.swp
[Sat Sep 05 19:21:04.204011 2026] [authz ...
show more
[Sat Sep 05 19:21:04.198347 2026] [authz_core:error] [pid 26875:tid 139766263694912] [client 34.185.79.63:36840] AH01630: client denied by server configuration: /var/www/public_html/symposium/wp-config.php.swp
[Sat Sep 05 19:21:04.204011 2026] [authz_core:error] [pid 26875:tid 139765592606272] [client 34.185.79.63:36716] AH01630: client denied by server configuration: /var/www/public_html/symposium/.env.bak
[Sat Sep 05 19:21:04.206140 2026] [authz_core:error] [pid 26876:tid 139763898099264] [client 34.185.79.63:36830] AH01630: client denied by server configuration: /var/www/public_html/symposium/wp-config.php~
...
show less
Bad Web Bot
🇬🇧
consul.to
2026-09-06 01:01:48
UTC ·
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
🇬🇧
Celtic
2026-09-05 22:19:45
UTC ·
(2 months ago)
Blocked by Fail2Ban with Jail (plesk-modsecurity)
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-09-05 22:01:13
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-04.
Web App Attack
SSH
Hacking
2026-09-05 21:11:07
UTC ·
(2 months ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 15:19:15
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 11:19:09.036494 2026] [security2:error] [pid 9565:tid 956 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 11:19:09.036494 2026] [security2:error] [pid 9565:tid 9565] [client 34.185.79.63:38260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.csmedicalbilling.com"] [uri "/.env.bak"] [unique_id "aprhbROFhBn_gJe8WTP8lwAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:16:57
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:16:51.355908 2026] [security2:error] [pid 22144:tid 22 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:16:51.355908 2026] [security2:error] [pid 22144:tid 22144] [client 34.185.79.63:35872] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "techskill.net"] [uri "/.env.bak"] [unique_id "aprEw7fkwi0dRR4cCAcYZwAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:23:16
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:23:09.646663 2026] [security2:error] [pid 16135:tid 16 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:23:09.646663 2026] [security2:error] [pid 16135:tid 16135] [client 34.185.79.63:55568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ericadamsdesign.com"] [uri "/.env.local"] [unique_id "apqqHRwT0QMJpwSMqqgzqgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:00:52
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:00:46.487904 2026] [security2:error] [pid 7836:tid 783 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:00:46.487904 2026] [security2:error] [pid 7836:tid 7836] [client 34.185.79.63:60046] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "humans2humans.org.asfmglobal.com"] [uri "/.env.production"] [unique_id "apqk3op_Eq0TpI8naHemogAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-09-04 10:50:24
UTC ·
(2 months ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after admin/path reconnaissance / port-scan-like web scan. Evidence: AttackPattern: /actuator/ (Match: /actuator/)
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:17:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:17:31.542092 2026] [security2:error] [pid 3235:tid 323 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.185.79.63 (63.79.185.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:17:31.542092 2026] [security2:error] [pid 3235:tid 3235] [client 34.185.79.63:45862] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "otraes.com"] [uri "/.env.dev"] [unique_id "apqaux5B33zyAblFDDKE_QAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack