🇮🇳
walkintoadmin
2026-09-16 14:03:18
UTC ·
(1 month ago)
GCP fleet: Vite /@fs/ path-traversal + cloud-credential harvester, spoofed bot UA; 236 reqs/1d, scanner-path ratio 0.85, 0 real-user 200s
Bad Web Bot
Web App Attack
🇨🇭
Peter-Johann Sarbach
2026-09-07 22:04:29
UTC ·
(2 months ago)
Hacking website
Hacking
🇳🇱
homeshowdomain.nl
2026-09-07 21:59:06
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-06.
Web App Attack
SSH
Hacking
🇫🇷
mail.avx.gr
2026-09-07 10:34:19
UTC ·
(2 months ago)
(nginxENVSCAN) nginx environment-file scanner detected from 34.58.12.8 (US/United States/Iowa/Council Bluffs/8.12.58.34.bc.googleusercontent.com)
Hacking
🇧🇪
cmbplf
2026-09-07 10:28:29
UTC ·
(2 months ago)
3.456 requests with url.path */@fs/*
832 requests with url.path *.aws/*
427 requests with url.path *config.json
338 requests with url.path *.config/*
248 requests with url.path */proc/*
241 requests with url.path *.azure/*
229 requests with ur ...
show more
3.456 requests with url.path */@fs/*
832 requests with url.path *.aws/*
427 requests with url.path *config.json
338 requests with url.path *.config/*
248 requests with url.path */proc/*
241 requests with url.path *.azure/*
229 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-07 10:20:26
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 06:20:20.310207 2026] [security2:error] [pid 328006:tid 32801 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 06:20:20.310207 2026] [security2:error] [pid 328006:tid 328011] [client 34.58.12.8:42334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.josephablumphotography.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252froot/.env"] [unique_id "ap6P5NmC3KD-cHRGzP7EeAAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-07 08:40:18
UTC ·
(2 months ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 08:21:20
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 04:21:13.348031 2026] [security2:error] [pid 3806:tid 3806] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 04:21:13.348031 2026] [security2:error] [pid 3806:tid 3806] [client 34.58.12.8:35566] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.vyendari.com"] [uri "/@fs/.env.local"] [unique_id "ap5z-TgZ1oZFRd8KT4WJ-QAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
sdos.es
2026-09-07 07:40:42
UTC ·
(2 months ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env.production"
Web App Attack
🇳🇱
Site.eu
2026-09-07 07:25:04
UTC ·
(2 months ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
Petros Stefanakis
2026-09-07 07:02:45
UTC ·
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted] 34.58.12.8 (US/United States/8.12.58.34.bc.googleusercontent.com)
SQL Injection
2026-09-07 06:28:18
UTC ·
(2 months ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-09-07 05:25:26
UTC ·
(2 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 05:22:15
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 01:22:09.012590 2026] [security2:error] [pid 17228:tid 17228] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 01:22:09.012590 2026] [security2:error] [pid 17228:tid 17228] [client 34.58.12.8:23388] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.isleofcain.com"] [uri "/@fs/app/.env"] [unique_id "ap5KAd-C8n6vUFiGyKrbGAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 04:52:37
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 00:52:32.367614 2026] [security2:error] [pid 10967:tid 10967] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.12.8 (8.12.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 00:52:32.367614 2026] [security2:error] [pid 10967:tid 10967] [client 34.58.12.8:39256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "realtorchristmascards.com"] [uri "/@fs/../../.env"] [unique_id "ap5DEDlw-jqdTJZk-x7Z-gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
