🇨🇭
🇨🇭 Hosting
2026-06-12 05:10:15
(1 week ago)
Automated WAF report: 125-150 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-06-11 09:50:04
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-06-11 02:16:56
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2026-06-11 01:08:13
(1 week ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇨🇭
4server
2026-06-10 12:01:14
(1 week ago)
[WedJun1014:01:12.9493112026][security2:error][pid2016145:tid2016655][client34.21.191.115:0]ModSecur ...
show more
[WedJun1014:01:12.9493112026][security2:error][pid2016145:tid2016655][client34.21.191.115:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"piffarerio.ch.81-17-25-250.cpanel.site\"][uri\"/api/.env\"][unique_id\"ailSCPMbnR-aYCwuz5P6QgAAAIs\"]
show less
Hacking
Web App Attack
🇳🇱
Site.eu
2026-06-10 08:38:07
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
updown.io
2026-06-10 05:30:26
(1 week ago)
{"level":"info","ts":1781069425.3856366,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781069425.3856366,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.21.191.115","remote_port":"36564","client_ip":"34.21.191.115","proto":"HTTP/1.1","method":"GET","host":"jupdate.baupdate.yxwvutsrutsnmlbnnkwkyxzxwww8bab2a5f-df77-4330-8c52-284b6b1ab1f1.random.159.89.98.98.nip.io","uri":"/.env.local","headers":{"Connection":["close"],"User-Agent":["Mozilla/5.0 (X11; FreeBSD amd64; rv:5.0) Gecko/20100101 Firefox/5.0"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"]}},"bytes_read":0,"user_id":"","duration":0.000138975,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://jupdate.baupdate.yxwvutsrutsnmlbnnkwkyxzxwww8bab2a5f-df77-4330-8c52-284b6b1ab1f1.random.159.89.98.98.nip.io/.env.local"],"Content-Type":[]}}
{"level":"info","ts":1781069425.4078624,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.21.191.115","remote_port":"36580","client_ip":"34.21.
...
show less
DDoS Attack
Web App Attack
🇬🇧
openstrike.co.uk
2026-06-10 05:14:25
(1 week ago)
142 attacks on env grabbing URLs:
GET /backend/.env.old HTTP/1.1
Hacking
🇨🇭
🇨🇭 Hosting
2026-06-10 05:10:26
(1 week ago)
Automated WAF report: 100-125 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
2026-06-10 00:10:12
(1 week ago)
(caddyscan) Scanner path probe from 34.21.191.115 (SG/Singapore/115.191.21.34.bc.googleusercontent.c ...
show more
(caddyscan) Scanner path probe from 34.21.191.115 (SG/Singapore/115.191.21.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.21.191.115 - - [10/Jun/2026:00:10:10 +0000] "GET /v2/.env HTTP/1.1"
[REDACTED] 200 2627 34.21.191.115 - - [10/Jun/2026:00:10:10 +0000] "GET /.env.prod.bak HTTP/1.1"
[REDACTED] 200 2627 34.21.191.115 - - [10/Jun/2026:00:10:10 +0000] "GET /production/.env HTTP/1.1"
[REDACTED] 200 2627 34.21.191.115 - - [10/Jun/2026:00:10:10 +0000] "GET /v1/.env HTTP/1.1"
[REDACTED] 200 2627 34.21.191.115 - - [10/Jun/2026:00:10:10 +0000] "GET /api/v3/.env HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-09 22:07:18
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.21.191.115 (115.191.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.191.115 (115.191.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:07:13.013234 2026] [security2:error] [pid 29291:tid 29291] [client 34.21.191.115:40440] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.valuerec.jmarkcapital.com"] [uri "/.env.prod.bak"] [unique_id "aiiOkXOhMjzdR970XVuIwgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-06-09 22:02:03
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-08.
show less
Web App Attack
SSH
Hacking
2026-06-09 17:17:13
(2 weeks ago)
Bot / seems abusive / Apache connections: 191
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇳🇱
Cloud86 B.V.
2026-06-09 16:13:09
(2 weeks ago)
categories: DDoS Attack
DDoS Attack
🇺🇸
TPI-Abuse
2026-06-09 13:52:49
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.21.191.115 (115.191.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.191.115 (115.191.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 09:52:45.327885 2026] [security2:error] [pid 15965:tid 15983] [client 34.21.191.115:59204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "spookytreerecords.com.danfriel.com"] [uri "/.env.pre-production"] [unique_id "aigarYkKCZ7WHx0Vd-_f8gAAANA"]
show less
Brute-Force
Bad Web Bot
Web App Attack