🇫🇷
✨
2026-08-29 02:25:14
(43 minutes ago)
Domain : pragma360.com
Rule : env
2026-08-29 02:23:22 ***hidden-privacy*** GET /.env.example - 80 - ...
show more
Domain : pragma360.com
Rule : env
2026-08-29 02:23:22 ***hidden-privacy*** GET /.env.example - 80 - 34.48.168.18 HTTP/1.1 crusader-worker/1.0 - www.pragma360.com 301 0 0 424 101 115 - -
show less
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-08-29 02:02:59
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:02:52.616085 2026] [security2:error] [pid 15728:tid 15728] [client 34.48.168.18:49104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whore-cams.com"] [uri "/.env.bak"] [unique_id "apI9zGYaG83vb1XGajF7-QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 01:22:53
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 21:22:48.376612 2026] [security2:error] [pid 18991:tid 18991] [client 34.48.168.18:33270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.corporatepedals.vanemby.com"] [uri "/wp-config.php.bak"] [unique_id "apI0aAAAuw_x7m1mkw7zjQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Starburst SysOp Team
2026-08-29 01:03:55
(2 hours ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-nue6-1)
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-29 00:52:42
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 20:52:35.532516 2026] [security2:error] [pid 2169:tid 2169] [client 34.48.168.18:57134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lifeinsmoke.yeejia.net"] [uri "/.env.save"] [unique_id "apItUxhzu21LlI6uvkw0-gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
tmiland
2026-08-29 00:40:19
(2 hours ago)
(nginx_404) Dot directory Honeypot Trap 34.48.168.18 (US/United States/18.168.48.34.bc.googleusercon ...
show more
(nginx_404) Dot directory Honeypot Trap 34.48.168.18 (US/United States/18.168.48.34.bc.googleusercontent.com): 2 in the last 3600 secs; IP: 34.48.168.18; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.48.168.18 - - [29/Aug/2026:02:40:17 +0200] "GET /.env.backup HTTP/1.1" 404 2992 "-" "crusader-worker/1.0" 34.48.168.18 - - [29/Aug/2026:02:40:17 +0200] "GET /.env.example HTTP/1.1" 404 2992 "-" "crusader-worker/1.0"
show less
Brute-Force
🇺🇸
mnsf
2026-08-29 00:09:06
(2 hours ago)
Abuse Detected (15)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 23:58:21
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:58:17.620332 2026] [security2:error] [pid 14654:tid 14654] [client 34.48.168.18:60022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.air-comfort-inc.sophcomp.com"] [uri "/.env.prod"] [unique_id "apIgmVHVYGpkhdU4fTV7fwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-28 22:58:03
(4 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.old HTTP/1.1, GET /.env.prod HTTP/1.1, GET /actuat ...
show more
Bot / scanning and/or hacking attempts: GET /.env.old HTTP/1.1, GET /.env.prod HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.backup HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /.env HTTP/1.1, GET /.env.dev HTTP/1.1, GET /env HTTP/1.1, GET /wp-config.php.swp HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.example HTTP/1.1, GET /actuator/env HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.save HTTP/1.1, GET /_ignition/health-check HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 22:55:27
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 18:55:21.763627 2026] [security2:error] [pid 27264:tid 27264] [client 34.48.168.18:42910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psychologists-omega.com"] [uri "/.env.production"] [unique_id "apIR2aUHS-ZchczAJxzUbAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-08-28 22:18:45
(4 hours ago)
34.48.168.18 - - [29/Aug/2026:06:18:39 +0800] "GET /wp-config.php~ HTTP/1.1" 301 453 "-" "crusader-w ...
show more
34.48.168.18 - - [29/Aug/2026:06:18:39 +0800] "GET /wp-config.php~ HTTP/1.1" 301 453 "-" "crusader-worker/1.0"
34.48.168.18 - - [29/Aug/2026:06:18:40 +0800] "GET /wp-config.php.swp HTTP/1.1" 301 459 "-" "crusader-worker/1.0"
34.48.168.18 - - [29/Aug/2026:06:18:38 +0800] "GET /wp-config.php.bak HTTP/1.1" 404 48442 "-" "crusader-worker/1.0"
34.48.168.18 - - [29/Aug/2026:06:18:40 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 459 "-" "crusader-worker/1.0"
34.48.168.18 - - [29/Aug/2026:06:18:38 +0800] "GET /wp-config.php~ HTTP/1.1" 404 48442 "-" "crusader-worker/1.0"
34.48.168.18 - - [29/Aug/2026:06:18:38 +0800] "GET /wp-config.php.swp HTTP/1.1" 404 48442 "-" "crusader-worker/1.0"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-08-28 21:53:47
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.48.168.18 (18.168.48.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 17:53:42.272806 2026] [security2:error] [pid 23845:tid 23845] [client 34.48.168.18:32884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dtla2028.com"] [uri "/.env.example"] [unique_id "apIDZqZT9-CyVNOe3E3WjQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-28 21:25:26
(5 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.48.168.18 (US/United States/18.168.48.34. ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.48.168.18 (US/United States/18.168.48.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.48.168.18 - - [28/Aug/2026:23:25:23 +0200] "GET /.env HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
34.48.168.18 - - [28/Aug/2026:23:25:23 +0200] "GET /.env.example HTTP/1.1" 406 4831 "-" "crusader-worker/1.0"
34.48.168.18 - - [28/Aug/2026:23:25:23 +0200] "GET /.env.prod HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
show less
Port Scan
🇺🇦
URAN Publishing Service
2026-08-28 21:14:16
(5 hours ago)
[29/Aug/2026:00:14:16 +0300] -- 34.48.168.18 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env. ...
show more
[29/Aug/2026:00:14:16 +0300] -- 34.48.168.18 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.backup HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-08-28 19:45:11
(7 hours ago)
fail2ban-ban
Hacking
Brute-Force
Exploited Host
Web App Attack