2026-08-26 00:55:02
(2 minutes ago)
suspicious request in access.log
Web App Attack
🇩🇪
LRob
2026-08-26 00:35:18
(22 minutes ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env (+1 more) | 2026-08-26 00:35 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 00:17:34
(40 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 20:17:29.388759 2026] [security2:error] [pid 10416:tid 10416] [client 34.21.128.95:14060] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ageh.com"] [uri "/.env"] [unique_id "ao4wmTpxJgcHHrf7vsaGBQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 23:21:49
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 19:21:41.386292 2026] [security2:error] [pid 28125:tid 28125] [client 34.21.128.95:54608] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agapeaccounting.com"] [uri "/.env"] [unique_id "ao4jhfE0sF4pOO4-4CblIgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-25 23:21:01
(1 hour ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1, GET /.env HTTP/1.1, GET /wp-confi ...
show more
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1, GET /.env HTTP/1.1, GET /wp-config.php-backup HTTP/1.1, GET /config.json HTTP/1.1, GET /.env.bak HTTP/1.1
show less
Hacking
Web App Attack
🇷🇺
DZBOT
2026-08-25 22:48:07
(2 hours ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇳🇱
Mangelot Hosting
2026-08-25 21:41:41
(3 hours ago)
(wp_config_access) srv101 WordPress wp-config Scan 34.21.128.95 (SG/Singapore/95.128.21.34.bc.google ...
show more
(wp_config_access) srv101 WordPress wp-config Scan 34.21.128.95 (SG/Singapore/95.128.21.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇫🇷
dynamix
2026-08-25 20:42:15
(4 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 20:11:13
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 16:11:06.795798 2026] [security2:error] [pid 18105:tid 18105] [client 34.21.128.95:35392] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "afjm.net"] [uri "/.env"] [unique_id "ao322pQ3n3PQGtjSCgAPqgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 18:30:47
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 14:30:42.991719 2026] [security2:error] [pid 5286:tid 5286] [client 34.21.128.95:37386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "afdfurniture.com"] [uri "/.env"] [unique_id "ao3fUt0R3ruesVovHm6tNAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jfz-abuse
2026-08-25 18:24:55
(6 hours ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 17:54:49
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 13:54:41.044344 2026] [security2:error] [pid 31101:tid 31101] [client 34.21.128.95:10584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thekingtones.com"] [uri "/.git/config"] [unique_id "ao3W4T8rMRi5tyQsEE_oFAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-08-25 17:50:59
(7 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.21.128.95 (SG/Singapore/95.128.21.34.bc.goog ...
show more
(mod_security) mod_security (id:949110) triggered by 34.21.128.95 (SG/Singapore/95.128.21.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 17:21:50
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 13:21:45.804212 2026] [security2:error] [pid 19892:tid 19892] [client 34.21.128.95:58370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aes-nihil.com"] [uri "/.env"] [unique_id "ao3PKYAwthvaDQDlZ2NL4AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 16:20:01
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.128.95 (95.128.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 12:19:57.866890 2026] [security2:error] [pid 7405:tid 7405] [client 34.21.128.95:46854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "koreasesame.com"] [uri "/.git/config"] [unique_id "ao3ArRo1x2Zc7lEno1mZnQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack