2026-09-14 22:12:22
UTC ·
(2 months ago)
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
[Tue Sep 08 02:13:31.393323 2026] [authz_core:erro ...
show more
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
[Tue Sep 08 02:13:31.393323 2026] [authz_core:error] [pid 183446:tid 183561] [client 34.26.212.73:20800] AH01630: client denied by server configuration: /var/www/_live/pay.fesoplast.hu/html/.htpasswd
...
show less
Brute-Force
Web App Attack
🇮🇳
evicky2002
2026-09-09 00:01:20
UTC ·
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
2026-09-08 12:04:00
UTC ·
(2 months ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-09-08 12:01:15
UTC ·
(2 months ago)
Automatically blocked due to distributed attack
Hacking
2026-09-08 11:35:12
UTC ·
(2 months ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-08 09:28:56
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 05:28:48.680290 2026] [security2:error] [pid 5168:tid 516 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 05:28:48.680290 2026] [security2:error] [pid 5168:tid 5168] [client 34.26.212.73:46916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.skintherapynola.com"] [uri "/@fs/root/.env"] [unique_id "ap_VUIEZQ-6fhF3I5QvFoAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 08:53:04
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 04:52:59.529607 2026] [security2:error] [pid 2541:tid 254 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 04:52:59.529607 2026] [security2:error] [pid 2541:tid 2541] [client 34.26.212.73:7896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sonoranwaterworks.com"] [uri "/@fs/.env"] [unique_id "ap_M69cjpqGG3IOplndN0gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-08 06:49:18
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 02:49:12.484974 2026] [security2:error] [pid 12530:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.212.73 (73.212.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 02:49:12.484974 2026] [security2:error] [pid 12530:tid 12587] [client 34.26.212.73:60594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newsrank.us"] [uri "/@fs/.env"] [unique_id "ap-v6NNAf-0mj2AyoppwBAAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-08 06:46:41
UTC ·
(2 months ago)
Web App Attack
🇩🇪
onlyops.app
2026-09-08 06:00:12
UTC ·
(2 months ago)
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-modsecurity jail) | onlyops.app
Exploited Host
🇺🇸
mnsf
2026-09-08 05:05:18
UTC ·
(2 months ago)
Scanning/Probing (106)
Request Overload (126)
Brute-Force
Web App Attack
🇳🇱
Roderic
2026-09-08 04:17:58
UTC ·
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
2026-09-08 03:50:02
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /.azure/azureProfile.json HTTP/1.1, GET /home/azureuser/.azure/credentials HTTP/1.1, GET /app/.env.local HTTP/1.1, GET /secrets.env HTTP/1.1, GET /creds.json HTTP/1.1, GET /sendgrid.env HTTP/1.1, GET /aws-c ...
show more
Bot / scanning and/or hacking attempts: GET /.azure/azureProfile.json HTTP/1.1, GET /home/azureuser/.azure/credentials HTTP/1.1, GET /app/.env.local HTTP/1.1, GET /secrets.env HTTP/1.1, GET /creds.json HTTP/1.1, GET /sendgrid.env HTTP/1.1, GET /aws-credentials.json HTTP/1.1, GET /dev/.env HTTP/1.1, GET /appsettings.json HTTP/1.1, GET /staging/.env HTTP/1.1, GET /.env.docker HTTP/1.1, GET /.github/workflows/deploy.yml HTTP/1.1, GET /home/ubuntu/.azure/credentials HTTP/1.1, GET /app/.env.production HTTP/1.1, GET /config/anthropic.json HTTP/1.1, GET /config/master.key HTTP/1.1, GET /.azure/config HTTP/1.1, GET /.gitlab-ci.yml HTTP/1.1
show less
Hacking
Web App Attack
2026-09-08 03:33:23
UTC ·
(2 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇫🇷
Octopuce
2026-09-08 03:05:15
UTC ·
(2 months ago)
Aggressive web search of vulnerable pages: /img../.env /.docker/.env /api/.env /.env.local /uploads../.env ...
Web App Attack