🇺🇸
zcampbell
2026-11-08 02:45:02
UTC ·
(6 minutes ago)
Web vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automatically.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 02:37:36
UTC ·
(14 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.22.196.121 (121.196.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:37:30.358496 2026] [security2:error] [pid 16500:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.196.121 (121.196.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:37:30.358496 2026] [security2:error] [pid 16500:tid 16500] [client 34.22.196.121:36892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1214productions.com"] [uri "/.aws/.env"] [unique_id "au_gau9cUK-56ll626fTgQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-08 02:01:19
UTC ·
(50 minutes ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
LotPhantom
2026-11-08 01:13:31
UTC ·
(1 hour ago)
2026/11/08 01:13:30 [error] 63471#63471: *26484 access forbidden by rule, client: 34.22.196.121, server: wynnesmiles.com, request: "GET /.aws/config HTTP/2.0", host: "wynnesmiles.com"
...
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 01:11:58
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.22.196.121 (121.196.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:11:53.992697 2026] [security2:error] [pid 11783:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.196.121 (121.196.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:11:53.992697 2026] [security2:error] [pid 11783:tid 11783] [client 34.22.196.121:59418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vyendari.com.greighhouse.com"] [uri "/.aws/.env"] [unique_id "au_MWUwImNC17be8LPobKQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-08 01:11:06
UTC ·
(1 hour ago)
Try to access /.docker/laravel/app/.env
Web App Attack
🇫🇷
masterguru
2026-11-08 01:07:39
UTC ·
(1 hour ago)
Restricted File Access Attempt. Matched phrase ".aws/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇺🇸
francelink.fr
2026-11-08 01:06:27
UTC ·
(1 hour ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-08T00:13:25.000Z.
Web App Attack
🇩🇪
maxpower
2026-11-08 01:02:14
UTC ·
(1 hour ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.22.196.121 (BE/Belgium/121.196.22.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.22.196.121 - - [08/Nov/2026:02:02: ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.22.196.121 (BE/Belgium/121.196.22.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.22.196.121 - - [08/Nov/2026:02:02:11 +0100] "GET /.aws/credentials.bak HTTP/2.0" 404 355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" host=ramsesconsulting.com
show less
Port Scan
🇺🇸
printedwicked
2026-11-08 01:01:14
UTC ·
(1 hour ago)
PW Sentinel on printedwicked.com: blocked (decoy); request shapes: decoy. Automated report.
Bad Web Bot
🇩🇪
4server
2026-11-08 01:00:25
UTC ·
(1 hour ago)
[SunNov0802:00:19.1772912026][security2:error][pid3458603:tid3458696][client34.22.196.121:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacc ...
show more
[SunNov0802:00:19.1772912026][security2:error][pid3458603:tid3458696][client34.22.196.121:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"pietroviviani.ch\"][uri\"/.aws/credentials.bak\"][unique_id\"au_JozsheZQeTeuOtIkxzgAAAMc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
Philister11
2026-11-08 00:53:31
UTC ·
(1 hour ago)
CrowdSec: crowdsecurity/http-crawl-non_statics (BE/AS396982)
Bad Web Bot
Web App Attack
🇦🇺
nzhost.co.nz
2026-11-08 00:52:24
UTC ·
(1 hour ago)
$f2bV_matches
Hacking
Brute-Force
🇨🇭
zynex
2026-11-08 00:51:46
UTC ·
(2 hours ago)
URL Probing: /.docker/laravel/app/.env
Web App Attack
🇩🇪
kivitendo.de
2026-11-08 00:51:46
UTC ·
(2 hours ago)
[Sun Nov 08 01:51:48.059255 2026] [access_compat:error] [pid 65312:tid 65353] [client 34.22.196.121:48806] AH01797: client denied by server configuration: /var/www/kivitendo-erp/.git/config
[Sun Nov 08 01:51:48.060045 2026] [access_compat:error] [pid ...
show more
[Sun Nov 08 01:51:48.059255 2026] [access_compat:error] [pid 65312:tid 65353] [client 34.22.196.121:48806] AH01797: client denied by server configuration: /var/www/kivitendo-erp/.git/config
[Sun Nov 08 01:51:48.060045 2026] [access_compat:error] [pid 65311:tid 65319] [client 34.22.196.121:48836] AH01797: client denied by server configuration: /var/www/kivitendo-erp/.git/index
...
show less
Brute-Force
Web App Attack
