🇬🇧
openstrike.co.uk
2026-09-02 05:13:34
(1 month ago)
13 attacks on env grabbing URLs, PHP URLs:
GET /.env.backup HTTP/1.1
GET /wp-config.php~ HTTP/1.1
Hacking
Web App Attack
🇺🇸
mnsf
2026-09-01 23:05:27
(1 month ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-09-01 05:16:41
(1 month ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 05:08:30
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 01:08:25.710703 2026] [security2:error] [pid 226455:tid 226559] [client 34.26.93.177:41740] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eldesvandemaggie.com.emehache.net"] [uri "/.env.old"] [unique_id "apZdybAlSH7yQ6QV7T0S3wAAAM8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 04:35:35
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:35:28.590136 2026] [security2:error] [pid 9698:tid 9725] [client 34.26.93.177:34858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "holoshot.geoception.com"] [uri "/.env.bak"] [unique_id "apZWEMPRAc5mRpoGQV9C_wAAAVE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-09-01 03:10:05
(1 month ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 03:03:46
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:03:39.516527 2026] [security2:error] [pid 12717:tid 12717] [client 34.26.93.177:57740] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "beckersystems.net"] [uri "/wp-config.php.bak"] [unique_id "apZAi6aQX8-c-1KUcwfSCAAAADg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-01 02:23:15
(1 month ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php.swp (+12 more) | 2026-09-01 02:23 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 00:13:12
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 20:13:07.931123 2026] [security2:error] [pid 30166:tid 30166] [client 34.26.93.177:41684] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.advantageinvestigation.com"] [uri "/.env.save"] [unique_id "apYYk6BgznAO0JiGK5eSFgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 23:31:27
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 19:31:19.367520 2026] [security2:error] [pid 30928:tid 30928] [client 34.26.93.177:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cdn-7.socialstudiesforkids.com"] [uri "/.env.prod"] [unique_id "apYOxzOhryVkWK3TlP5ddAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-08-31 22:44:11
(1 month ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-31 22:38:50
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.26.93.177 (177.93.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 18:38:46.943000 2026] [security2:error] [pid 15684:tid 15684] [client 34.26.93.177:32932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "beeswaxnews.com"] [uri "/.env.bak"] [unique_id "apYCdlKRhbYAkvnuhc3z1gAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-08-31 22:17:04
(1 month ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-08-31 22:05:18
(1 month ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇦
Olexiy Backend
2026-08-31 21:41:36
(1 month ago)
34.26.93.177
...
Bad Web Bot
Web App Attack
