Anonymous
2026-09-06 03:55:01
(1 day ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 03:52:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:52:33.640136 2026] [security2:error] [pid 26204:tid 26211] [client 34.22.88.40:48984] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.ouye.us"] [uri "/.env.save"] [unique_id "apzjgdBbnM4DZJ7oJiN9ZgAAAQQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 03:27:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:27:04.783743 2026] [security2:error] [pid 21198:tid 21198] [client 34.22.88.40:53578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "celebritybikinigossip.com"] [uri "/wp-config.php~"] [unique_id "apzdiHxOTFqA_yNkTaD1lgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
paulo.apoloni
2026-09-06 03:19:35
(1 day ago)
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.example HTTP/1.1" 404 0 "-" "crusader-worker ...
show more
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.example HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.local HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.prod HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.dev HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
34.22.88.40 - - [06/Sep/2026:00:19:35 -0300] "GET /.env.production HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇬🇧
blik2108
2026-09-06 02:32:09
(1 day ago)
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /.env.production HTTP/1.1" 404 3431 "-" "crusader- ...
show more
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /.env.production HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /.env.local HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /.env.backup HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /env HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /wp-config.php~ HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /wp-config.php.swp HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /actuator/configprops HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
34.22.88.40 - - [06/Sep/2026:02:32:08 +0000] "GET /.env.old HTTP/1.1" 404 3431 "-" "crusader-worker/1.0" "-"
...
show less
Web App Attack
🇫🇷
✨
2026-09-06 02:27:12
(1 day ago)
Domain : skene-design.co.uk
Rule : hack
2026-09-06 02:26:05 W3SVC556 PLESK72 79.171.34.53 GET /wp-co ...
show more
Domain : skene-design.co.uk
Rule : hack
2026-09-06 02:26:05 W3SVC556 PLESK72 79.171.34.53 GET /wp-config.php.bak - 443 - 34.22.88.40 HTTP/1.1 crusader-worker/1.0 - - skene-design.co.uk 404 0 2 1401 107 488 - -
show less
Hacking
SQL Injection
Brute-Force
🇳🇱
e.fierstra
2026-09-06 02:20:35
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇦🇺
A.i.D.A.N.N
2026-09-06 02:20:09
(1 day ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web application attack detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 01:43:40
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:43:36.724352 2026] [security2:error] [pid 982:tid 982] [client 34.22.88.40:52520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flashbackmusicmemories.com"] [uri "/.env.dev"] [unique_id "apzFSNohP8g5bGL1peApNwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-09-06 01:34:38
(1 day ago)
Repeated exploit attempts, for example: /actuator/env /actuator/ (HTTP/1.1 port 443)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 01:15:46
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:15:41.761126 2026] [security2:error] [pid 15236:tid 15236] [client 34.22.88.40:36342] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.2ndwaveai.com"] [uri "/.env.old"] [unique_id "apy-vQqZFWx5Jbr0yG6VRgAAAHg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-06 01:05:22
(1 day ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 00:51:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:51:27.732075 2026] [security2:error] [pid 7976:tid 7976] [client 34.22.88.40:50042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "escribaniasmith.com.ar"] [uri "/wp-config.php~"] [unique_id "apy5D9-LN_854U_Ll-wDjQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 00:06:24
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.22.88.40 (40.88.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:06:16.258211 2026] [security2:error] [pid 19026:tid 19026] [client 34.22.88.40:46014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "papelandia.com.ve"] [uri "/.env.save"] [unique_id "apyueD3-Mmt94q3XC__SqgAAAIs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-09-05 23:24:39
(1 day ago)
[SunSep0601:24:36.6615392026][security2:error][pid2222492:tid2223990][client34.22.88.40:0]ModSecurit ...
show more
[SunSep0601:24:36.6615392026][security2:error][pid2222492:tid2223990][client34.22.88.40:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"xn--walter-wrndli-pmb.ch\"][uri\"/.env.save\"][unique_id\"apyktJM_0Cw4nK1edgtNDwAAARY\"]
show less
Hacking
Web App Attack