🇧🇪
cmbplf
2026-09-08 20:35:36
(1 hour ago)
2.733 requests with url.path */@fs/*
1.732 requests with url.path *.env
779 requests with url.pat ...
show more
2.733 requests with url.path */@fs/*
1.732 requests with url.path *.env
779 requests with url.path *.aws/*
665 requests with url.path *config.json
656 requests with url.path *credentials.json
529 requests with url.path *.config/*
248 requests with url.path *.ssh/*
227 requests with url.path */proc/*
157 requests with url.path */auth.json
109 requests with url.path *config.php
show less
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-08 20:25:24
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 16:25:20.688540 2026] [security2:error] [pid 6819:tid 6819] [client 34.21.186.195:43448] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.dualspiralsystems.com"] [uri "/@fs/.env"] [unique_id "aqBvMANxgOnpGMHoSRiM7AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 20:05:58
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 16:05:53.806567 2026] [security2:error] [pid 23233:tid 23317] [client 34.21.186.195:56996] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.geoception.com"] [uri "/@fs/src/.env"] [unique_id "aqBqoUgylPkq6q74MssEVQAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 19:45:00
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 15:44:54.631197 2026] [security2:error] [pid 13538:tid 13538] [client 34.21.186.195:33386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.mindtekt.com"] [uri "/@fs/src/.env"] [unique_id "aqBlttWUvtxK57PgxgXmuwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 19:21:09
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 15:21:05.130396 2026] [security2:error] [pid 8248:tid 8248] [client 34.21.186.195:52238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dojoonthego.com"] [uri "/@fs/root/.env"] [unique_id "aqBgIVlHDjEF_EheAgAWpgAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 18:21:22
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 14:21:15.753087 2026] [security2:error] [pid 4022382:tid 4022382] [client 34.21.186.195:28786] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.bogans.net"] [uri "/@fs/root/.env"] [unique_id "aqBSG90VQjqSTlJunJ5NVQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-09-08 18:04:53
(4 hours ago)
Aggressive web search of vulnerable pages: /.env /v2/.env /.env.local /images../.env /img../.env .. ...
show more
Aggressive web search of vulnerable pages: /.env /v2/.env /.env.local /images../.env /img../.env ...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 18:00:55
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 14:00:50.211621 2026] [security2:error] [pid 6209:tid 6209] [client 34.21.186.195:3434] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.britanniapilates.com.systemcapacityoptimization.com"] [uri "/@fs/root/.env"] [unique_id "aqBNUtJUHwjIbBUkjRznbgAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-08 17:54:33
(4 hours ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
mc4bbs
2026-09-08 17:47:57
(4 hours ago)
Automated Apache detection on Windows host. 5 suspicious HTTP requests within 300 seconds. Examples: ...
show more
Automated Apache detection on Windows host. 5 suspicious HTTP requests within 300 seconds. Examples: GET /@fs/root/.env?raw?? -> 404 UA=""; GET /@fs/etc/passwd?raw?? -> 404 UA=""; GET /@fs/..%252f..%252f..%252f..%252f..%252fapp/.env?raw?? -> 404 UA=""; GET /@fs/../.env?raw?? -> 404 UA=""; GET /@fs/.env.production?raw?? -> 404 UA=""
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-08 17:44:36
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 13:44:32.761967 2026] [security2:error] [pid 1155:tid 1155] [client 34.21.186.195:27582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "photoboutiqueamerica.com"] [uri "/@fs/root/.env"] [unique_id "aqBJgPreNjudG6khSWoneQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-08 17:31:03
(4 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 17:10:40
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 13:10:34.453753 2026] [security2:error] [pid 12153:tid 12153] [client 34.21.186.195:43986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alan-ip.com"] [uri "/@fs/.env"] [unique_id "aqBBitoDAAW-FTN3F02btAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 16:32:18
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.186.195 (195.186.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 12:32:12.642722 2026] [security2:error] [pid 11800:tid 11800] [client 34.21.186.195:40998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.togo.scala-global.com"] [uri "/@fs/root/.env"] [unique_id "aqA4jKXNUVgNnQVOMuaiGgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-08 16:21:07
(5 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
