Anonymous
2026-07-29 07:00:00
UTC ·
(3 months ago)
Apache probe; attempts=612; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /.e ...
show more
Apache probe; attempts=612; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /.env.preprod | /.env.prod | /.env.production | /.env.remote | /.env.sample | /.env.save | /.env.stage | /.env.staging | /.env.swp | /.env.test | /.env.txt | /.env.uat | /.env.yaml | /.env.yml | /.env~ | /.git/.env | /.git/config | /actions/.env | /admin-panel/.env | /admin/.env | /administrator/.env | /angular/.env | /ansible/.env | /api/.env | /api/dev/.env | /api/staging/.env | /api/v1/.env | /api/v2/.env | /api/v3/.env | /app/.env | /application/.env | /apps/.env | /assets/.env | /aws/.env | /azure/.env | /backend/.env | /backup/.env | /backups/.env | /beta/.env | /bin/.env | /bootstrap/.env | /brevo/.env | /build/.env | /buildkite/.env | /bulk/.env | /cache/.en | ... [204 exact paths total]
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-07-27 22:01:21
UTC ·
(3 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-26.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-07-27 08:14:19
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 04:14:14.924441 2026] [security2:error] [pid 2964237 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 04:14:14.924441 2026] [security2:error] [pid 2964237:tid 2964237] [client 34.229.13.108:33546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrismoratz.com"] [uri "/.git/config"] [unique_id "amcTVkI3dma1kjgP9DfWYwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 07:42:13
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:42:06.564471 2026] [security2:error] [pid 3315668 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:42:06.564471 2026] [security2:error] [pid 3315668:tid 3315668] [client 34.229.13.108:49114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrisi-sharper.com"] [uri "/.git/config"] [unique_id "amcLzj-Qbu1sBDKOpSTeRAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 07:03:39
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:03:35.832394 2026] [security2:error] [pid 89913:t ...
show more
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:03:35.832394 2026] [security2:error] [pid 89913:tid 89913] [client 34.229.13.108:57492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrischamberlain.com"] [uri "/.git/config"] [unique_id "amcCx8xrqcO3JVTXJswl3AAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 06:37:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:37:20.967522 2026] [security2:error] [pid 15375:t ...
show more
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:37:20.967522 2026] [security2:error] [pid 15375:tid 15375] [client 34.229.13.108:32920] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrisamedee.com"] [uri "/.git/config"] [unique_id "amb8oAaq5UbzHcmafPfolAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-07-26 05:17:26
UTC ·
(3 months ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇮🇩
rafli
2026-07-26 03:34:32
UTC ·
(3 months ago)
{"level":"info","ts":1785036862.791213,"logger":"http.log.access.log16","msg":"handled request","request":{"remote_ip":"34.229.13.108","remote_port":"36614","client_ip":"34.229.13.108","proto":"HTTP/1.1","method":"POST","host":"console.oncall.id","ur ...
show more
{"level":"info","ts":1785036862.791213,"logger":"http.log.access.log16","msg":"handled request","request":{"remote_ip":"34.229.13.108","remote_port":"36614","client_ip":"34.229.13.108","proto":"HTTP/1.1","method":"POST","host":"console.oncall.id","uri":"/dashboard","headers":{"Content-Length":["748"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Next-Action":["x"],"X-Nextjs-Request-Id":["6d33e7a2"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"],"Content-Type":["multipart/form-data; boundary=--------WebKitFormBoundarye7fe752cbaf84d80"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"console.oncall.id","ech":false}},"bytes_read":748,"user_id":"","duration":0.011868494,"size":24,"status":404,"resp_headers":{"Etag":["\"b11cvpkueto\""],"Content-Length":["24"],"Cache-Control":["private, no-cache, no-store, max-age=0, must-reva
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 01:57:27
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 21:57:20.568739 2026] [security2:error] [pid 4106007 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.229.13.108 (ec2-34-229-13-108.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 21:57:20.568739 2026] [security2:error] [pid 4106007:tid 4106162] [client 34.229.13.108:44600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "conservativedemocrat.com"] [uri "/.git/config"] [unique_id "amVpgLuYOHvBDbw0HxlUNAAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
strefapi_com
2026-07-25 01:12:24
UTC ·
(3 months ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇩🇪
piticu iuli
2026-07-25 00:04:53
UTC ·
(3 months ago)
(mod_security) mod_security triggered on hostname [redacted] 34.229.13.108 (US/United States/ec2-34-229-13-108.compute-1.amazonaws.com)
SQL Injection
🇳🇱
Site.eu
2026-07-24 04:33:15
UTC ·
(3 months ago)
Excessive 404/403 errors
Brute-Force
🇮🇹
VHosting
2026-07-24 04:20:03
UTC ·
(3 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack