๐บ๐ธ
TPI-Abuse
2026-10-09 20:14:29
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 16:14:21.900920 2026] [security2:error] [pid 16277:tid 16277] [client 34.21.248.162:56980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "es.laboquimia.es"] [uri "/%2e%2e/.env"] [unique_id "aslLHS9b4J5CR2PEN2zU3QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐ธ
robotstxt
2026-10-09 18:40:35
(1 week ago)
34.21.248.162 - - [09/Oct/2026:18:40:31 +0000] "GET /.vite/manifest.json HTTP/2.0" 403 147 "-" "Mozi ...
show more
34.21.248.162 - - [09/Oct/2026:18:40:31 +0000] "GET /.vite/manifest.json HTTP/2.0" 403 147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "-"
34.21.248.162 - - [09/Oct/2026:18:40:32 +0000] "GET /.//.env HTTP/2.0" 403 189 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" "-"
34.21.248.162 - - [09/Oct/2026:18:40:32 +0000] "GET /css../.env HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)" "-"
34.21.248.162 - - [09/Oct/2026:18:40:32 +0000] "GET /static//.env HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" "-"
34.21.248.162 - - [09/Oct/2026:18:40:32 +0000] "GET /uploads../.env HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" "-"
...
show less
Web App Attack
Anonymous
2026-10-09 17:24:19
(1 week ago)
Aggressive web scan
Web App Attack
๐ช๐ธ
robotstxt
2026-10-09 16:55:26
(1 week ago)
34.21.248.162 - - [09/Oct/2026:16:54:41 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
34.21.24 ...
show more
34.21.248.162 - - [09/Oct/2026:16:54:41 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:16:54:42 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:16:54:42 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:16:54:42 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:16:54:42 +0000] "-" 400 193 "-" "-" "-" edge="34.21.248.162"
...
show less
Web Spam
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-09 16:35:58
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:35:53.432794 2026] [security2:error] [pid 22502:tid 22502] [client 34.21.248.162:50232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.husman.es"] [uri "/static../.env"] [unique_id "askX6Qhw1WtSjAYxdHm3xgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
LRNP
2026-10-09 15:36:57
(1 week ago)
aime.lesmatric.es:443 34.21.248.162 - - [09/Oct/2026:15:36:57 +0000] "GET /.env HTTP/2.0" 404 107 "- ...
show more
aime.lesmatric.es:443 34.21.248.162 - - [09/Oct/2026:15:36:57 +0000] "GET /.env HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
...
show less
Bad Web Bot
Web App Attack
๐ช๐ธ
Francisco Vallejo
2026-10-09 15:36:34
(1 week ago)
[Fri Oct 09 17:36:32.666666 2026] [core:info] [pid 2785296:tid 133276903655104] [client 34.21.248.16 ...
show more
[Fri Oct 09 17:36:32.666666 2026] [core:info] [pid 2785296:tid 133276903655104] [client 34.21.248.162:47334] AH00128: File does not exist: /var/www/franvallejo/manifest.json
[Fri Oct 09 17:36:32.926440 2026] [core:info] [pid 2785296:tid 133277440526016] [client 34.21.248.162:47334] AH00128: File does not exist: /var/www/franvallejo/webpack-stats.json
[Fri Oct 09 17:36:33.180540 2026] [core:info] [pid 2785296:tid 133277465704128] [client 34.21.248.162:47334] AH00128: File does not exist: /var/www/franvallejo/z9x8c7v6b5-debug-trigger-ai.franvallejo.es
[Fri Oct 09 17:36:33.180893 2026] [core:info] [pid 2948248:tid 133277155305152] [client 34.21.248.162:47402] AH00128: File does not exist: /var/www/franvallejo/9isoz2fruntftb6jhiup
[Fri Oct 09 17:36:33.180912 2026] [core:info] [pid 2948248:tid 133277432133312] [client 34.21.248.162:47392] AH00128: File does not exist: /var/www/franvallejo/dist/manifest.json
...
show less
Brute-Force
SSH
๐ง๐ช
cmbplf
2026-10-09 15:27:06
(1 week ago)
3.724 requests with url.path *.env
1.688 requests with url.path */@fs/*
376 requests with url.pat ...
show more
3.724 requests with url.path *.env
1.688 requests with url.path */@fs/*
376 requests with url.path */proc/*
272 requests with url.path *.aws/*
243 requests with url.path *config.json
220 requests with url.path *credentials.json
207 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
๐ง๐ช
voormedia
2026-10-09 15:22:47
(1 week ago)
Accessed trap at '/secrets.yml'
Web App Attack
๐ช๐ธ
robotstxt
2026-10-09 15:19:25
(1 week ago)
34.21.248.162 - - [09/Oct/2026:15:18:38 +0000] "GET /webpack-stats.json HTTP/2.0" 403 29525 "-" "Moz ...
show more
34.21.248.162 - - [09/Oct/2026:15:18:38 +0000] "GET /webpack-stats.json HTTP/2.0" 403 29525 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:18:39 +0000] "GET /assets/manifest.json HTTP/2.0" 403 29520 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:18:39 +0000] "GET /wp-content/cache/autoptimize/1/js/autoptimize_single_6857ed16327f63b33982ea69d8f73350.js HTTP/2.0" 403 165 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:18:39 +0000] "GET /dist/manifest.json HTTP/2.0" 403 29571 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "-" edge="34.21
...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-09 15:13:39
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.248.162 (162.248.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 11:13:32.456134 2026] [security2:error] [pid 17872:tid 17872] [client 34.21.248.162:40082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tand.es"] [uri "/.htpasswd"] [unique_id "askEnD2WZKG-qmeYxaQEqwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐ธ
robotstxt
2026-10-09 15:03:19
(1 week ago)
34.21.248.162 - - [09/Oct/2026:15:02:20 +0000] "GET /wp-content/plugins/contact-form-7/includes/swv/ ...
show more
34.21.248.162 - - [09/Oct/2026:15:02:20 +0000] "GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.2.1 HTTP/2.0" 403 16589 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:02:22 +0000] "GET /dist/manifest.json HTTP/2.0" 403 16555 "https://nextlevel.es/dist/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:02:22 +0000] "GET /build/manifest.json HTTP/2.0" 403 16417 "https://nextlevel.es/build/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.21.248.162"
34.21.248.162 - - [09/Oct/2026:15:02:22 +0000] "GET /dist/.vite/manifest.json HTTP/2.0" 403 16432 "https://nextlevel.es/dist/.vite/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
...
show less
Web App Attack
๐ง๐ช
voormedia
2026-10-09 15:03:17
(1 week ago)
Accessed trap at '/.bashrc'
Web App Attack
๐ณ๐ฑ
Alt255
2026-10-09 14:58:39
(1 week ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.21.248.162 - - [09/Oct/2026:16:58:21 +0200] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env HTTP/1.1" 403 518 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
...
show less
Bad Web Bot
Web App Attack
๐ซ๐ท
LRNP
2026-10-09 14:56:54
(1 week ago)
_:443 34.21.248.162 - - [09/Oct/2026:14:56:53 +0000] "GET /login HTTP/1.1" 404 181 "-" "Mozilla/5.0 ...
show more
_:443 34.21.248.162 - - [09/Oct/2026:14:56:53 +0000] "GET /login HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
_:443 34.21.248.162 - - [09/Oct/2026:14:56:53 +0000] "GET /auth/login HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
_:443 34.21.248.162 - - [09/Oct/2026:14:56:54 +0000] "GET /account/login HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
_:443 34.21.248.162 - - [09/Oct/2026:14:56:54 +0000] "GET /secure HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
_:443 34.21.248.162 - - [09/Oct/2026:14:56:54 +0000] "GET /user/login HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win
...
show less
Bad Web Bot
Web App Attack