๐บ๐ธ
TPI-Abuse
2026-08-28 05:12:21
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 01:12:18.432326 2026] [security2:error] [pid 173427:tid 173450] [client 34.32.167.14:45096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.debtsuspensionrights.credit-card-cap.com"] [uri "/@fs/.env.staging"] [unique_id "apEYsmbcPtvGkvJZj-h-swAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-28 04:24:03
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 00:23:55.963016 2026] [security2:error] [pid 19750:tid 19750] [client 34.32.167.14:38626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.jpastorphotographics.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252fapp/.env"] [unique_id "apENWwEKE6GYrP2WGaBFbgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Savvii
2026-08-28 03:43:49
(1 month ago)
20 attempts against mh-misbehave-ban on melon
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-28 03:35:08
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 23:35:04.595682 2026] [security2:error] [pid 8667:tid 8667] [client 34.32.167.14:17988] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.thegreatleapforward.com"] [uri "/@fs/root/.env"] [unique_id "apEB6I6NUp9K3TWB8zbh9QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-28 03:15:37
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 23:15:33.307250 2026] [security2:error] [pid 22746:tid 22746] [client 34.32.167.14:38624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sjhrc.org"] [uri "/@fs/root/.env"] [unique_id "apD9VSNq3LG_KneCmJdT4QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
gadix
2026-08-28 02:44:52
(1 month ago)
[28/Aug/2026:04:44:51.400312 +0200] apD2I-_nzvDZ2GgtmExLFAAAAAQ 34.32.167.14 41676 127.0.0.1 7081
[2 ...
show more
[28/Aug/2026:04:44:51.400312 +0200] apD2I-_nzvDZ2GgtmExLFAAAAAQ 34.32.167.14 41676 127.0.0.1 7081
[28/Aug/2026:04:44:51.402400 +0200] apD2I3_8NJGEWpzCcT5pLwAAAAU 34.32.167.14 41684 127.0.0.1 7081
[28/Aug/2026:04:44:51.408197 +0200] apD2I3NL9MFatzRi5C__xwAAAAA 34.32.167.14 41694 127.0.0.1 7081
...
show less
Web App Attack
Anonymous
2026-08-28 02:19:19
(1 month ago)
Aggressive web scan
Web App Attack
๐ซ๐ท
Octopuce
2026-08-28 01:16:23
(1 month ago)
Aggressive web search of vulnerable pages: /_nuxt/../.env /.docker/.env /img../.env /v1/.env /upload ...
show more
Aggressive web search of vulnerable pages: /_nuxt/../.env /.docker/.env /img../.env /v1/.env /uploads../.env ...
show less
Web App Attack
๐บ๐ธ
chrisj
2026-08-28 01:10:36
(1 month ago)
[Fri Aug 28 01:10:25.815600 2026] [proxy_fcgi:error] [pid 1506056:tid 1506147] [client 34.32.167.14: ...
show more
[Fri Aug 28 01:10:25.815600 2026] [proxy_fcgi:error] [pid 1506056:tid 1506147] [client 34.32.167.14:13090] AH01071: Got error 'Primary script unknown'
[Fri Aug 28 01:10:25.817383 2026] [proxy_fcgi:error] [pid 1506056:tid 1506151] [client 34.32.167.14:13120] AH01071: Got error 'Primary script unknown'
[Fri Aug 28 01:10:36.449267 2026] [proxy_fcgi:error] [pid 1506054:tid 1506128] [client 34.32.167.14:29624] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-08-28 01:08:35
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 21:08:28.036093 2026] [security2:error] [pid 29847:tid 29847] [client 34.32.167.14:25284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "reettaanttila.com"] [uri "/@fs/root/.env"] [unique_id "apDfjK3bHTsTuJpFcq0jmQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-28 00:43:12
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 20:43:07.825529 2026] [security2:error] [pid 20171:tid 20171] [client 34.32.167.14:44438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.heatherweathers.com"] [uri "/@fs/.env.development"] [unique_id "apDZm-DshR-bfFTX5iVihwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-08-28 00:32:16
(1 month ago)
Multiple web server 400 error codes from same source ip
Web App Attack
๐ช๐ธ
pipeline.es
2026-08-28 00:15:28
(1 month ago)
Web scanning / probing for vulnerable paths | URL: /@fs/.env.development?raw?? | Evidence: microsite ...
show more
Web scanning / probing for vulnerable paths | URL: /@fs/.env.development?raw?? | Evidence: microsites.grupoeuropa.com 34.32.167.14 - - [28/Aug/2026:02:15:16 +0200] \"GET /@fs/.env.development?raw?? HTTP/1.1\" 404 4189 \"-\" \"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0)\" GEOIP_COUNTRY_CODE=NL | ASN: GOOGLE-CLOUD-PLATFORM | Country: NL
show less
Port Scan
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-08-27 23:58:45
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.167.14 (14.167.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 19:58:36.908922 2026] [security2:error] [pid 13212:tid 13212] [client 34.32.167.14:24364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.intertecs.org"] [uri "/@fs/root/.env"] [unique_id "apDPLATzsOFmPzXfkpn6hQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Site.eu
2026-08-27 23:46:27
(1 month ago)
Excessive multi-domain requests
Brute-Force