🇺🇸
TPI-Abuse
2026-08-01 17:32:13
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:32:10.039305 2026] [security2:error] [pid 542475:tid 542475] [client 34.24.72.165:54340] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stricklinphotography.com"] [uri "/.env.prod"] [unique_id "am4tmsjJD75Kuf11NCFBJwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 17:13:29
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:13:20.073186 2026] [security2:error] [pid 2619649:tid 2619649] [client 34.24.72.165:36696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "keepingitsharp.biz"] [uri "/.env.dev"] [unique_id "am4pMNbEeALU-MTo0bJ40AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 17:10:45
(6 hours ago)
PSCSERV WPSCAN 34.24.72.165
Bad Web Bot
Web App Attack
🇳🇱
sernate
2026-08-01 17:03:47
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (US/United States/165.72.24.34.bc. ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (US/United States/165.72.24.34.bc.googleusercontent.com): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-08-01 16:46:47
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 12:46:43.008024 2026] [security2:error] [pid 871805:tid 871805] [client 34.24.72.165:44412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yosalvationyo.org.jimwilsongallery.com"] [uri "/.env.bak"] [unique_id "am4i85svqdAwkvltbcbJzAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 16:45:01
(7 hours ago)
suspicious request in access.log
Web App Attack
🇩🇪
big-cloud.nl
2026-08-01 15:52:31
(8 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:46:44
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:46:36.401917 2026] [security2:error] [pid 939373:tid 939373] [client 34.24.72.165:49264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jaykaydrone.krakowski.net"] [uri "/.env.prod"] [unique_id "am4U3KO_pWGBSfYHCAdWnAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-08-01 15:35:50
(8 hours ago)
CrowdSec abuse IP report (host SRV-2) Scenario: crowdsecurity/http-sensitive-files
Hacking
2026-08-01 15:29:04
(8 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.prod HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env ...
show more
Bot / scanning and/or hacking attempts: GET /.env.prod HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.old HTTP/1.1, GET /.env HTTP/1.1, GET /.env.production HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
pltcldvlpr
2026-08-01 15:22:59
(8 hours ago)
CMS/framework probe: 34.24.72.165 - - [01/Aug/2026:17:22:58 +0200] "GET /.env.local HTTP/1.1" 444 0 ...
show more
CMS/framework probe: 34.24.72.165 - - [01/Aug/2026:17:22:58 +0200] "GET /.env.local HTTP/1.1" 444 0 "-" "crusader-worker/1.0" asn=396982 org="Google LLC" country=US
...
show less
Web App Attack
🇫🇷
masterguru
2026-08-01 15:21:53
(8 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-08-01 15:15:55
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:15:47.893153 2026] [security2:error] [pid 1793381:tid 1793381] [client 34.24.72.165:38000] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noviasaltovacio.com"] [uri "/.env.old"] [unique_id "am4NoxN0n0PCDQid85a73wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 14:49:50
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.72.165 (165.72.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 10:49:45.836066 2026] [security2:error] [pid 2480574:tid 2480574] [client 34.24.72.165:59636] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.caralis.com"] [uri "/.env.bak"] [unique_id "am4HiTU3gSZqXd-Cmmh7ZAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-08-01 14:30:14
(9 hours ago)
[SatAug0116:30:09.5963702026][security2:error][pid3854332:tid3854347][client34.24.72.165:0]ModSecuri ...
show more
[SatAug0116:30:09.5963702026][security2:error][pid3854332:tid3854347][client34.24.72.165:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"swiss-sailing-system.ch\"][uri\"/.env.production\"][unique_id\"am4C8WCTJNl7g6604fd3ngAAAUA\"]
show less
Hacking
Web App Attack