🇺🇸
TPI-Abuse
2026-09-04 15:14:43
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 11:14:34.804403 2026] [security2:error] [pid 30211:tid 30211] [client 34.52.135.175:46648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.idahostem.org"] [uri "/.env.bak"] [unique_id "aprgWqXoMkmT3Vnu0EVaeAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:11:17
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:11:10.418450 2026] [security2:error] [pid 4355:tid 4372] [client 34.52.135.175:43980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.dpiazza.com"] [uri "/.env.dev"] [unique_id "aprRfsKZoYaNsgIbwhvBYQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-09-04 14:09:30
(8 hours ago)
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ...
show more
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths.
show less
Hacking
Brute-Force
Web App Attack
🇸🇪
cybertailor
2026-09-04 13:26:32
(8 hours ago)
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /storage/logs/laravel.log HTTP/1.1" 404 146 "-" ...
show more
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /storage/logs/laravel.log HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /.env.save HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /.env HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /.env.dev HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:18:26:29 +0500] "GET /actuator/configprops HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
...
show less
Port Scan
🇳🇱
WeCloudit-Anti-Abuse
2026-09-04 13:24:12
(8 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
yitzhaq
2026-09-04 12:56:59
(9 hours ago)
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 534 "-" "crusad ...
show more
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 534 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /wp-config.php~ HTTP/1.1" 301 528 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /.env.bak HTTP/1.1" 301 516 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /.env.production HTTP/1.1" 301 530 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /actuator/env HTTP/1.1" 301 524 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /.env.example HTTP/1.1" 301 524 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /.env.dev HTTP/1.1" 301 516 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /_ignition/health-check HTTP/1.1" 301 544 "-" "crusader-worker/1.0"
34.52.135.175 - - [04/Sep/2026:14:56:57 +0200] "GET /actuator/configprops HTTP/1.1" 301 540 "-" "crusader-wo
show less
Web App Attack
Brute-Force
🇩🇪
Skyrider
2026-09-04 12:54:20
(9 hours ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-04 12:31:17
(9 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 12:16:12
(9 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
sdos.es
2026-09-04 11:58:43
(10 hours ago)
"URL file extension is restricted by policy - .backup"
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:58:28
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:58:23.269566 2026] [security2:error] [pid 31849:tid 31849] [client 34.52.135.175:56204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "strawusa.com"] [uri "/.env"] [unique_id "apqyXzLpzksiF9Iua6joSQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-04 11:50:04
(10 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-09-04 11:18:18
(10 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
Anonymous
2026-09-04 11:07:09
(11 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:56:33
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.52.135.175 (175.135.52.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:56:26.233790 2026] [security2:error] [pid 32392:tid 32392] [client 34.52.135.175:38540] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bmillernotary.com"] [uri "/.env"] [unique_id "apqj2kX6itEN2zHrJ37ruwAAAGE"]
show less
Brute-Force
Bad Web Bot
Web App Attack