🇳🇱
Alt255
2026-09-11 12:39:52
UTC ·
(2 months ago)
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.bak HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:4 ...
show more
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.bak HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /wp-config.php.bak HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.old HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.dev HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.backup HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:03 +0200\] "GET /.env.production HTTP/1.1" 404 7982 "-" "crusader-worker/1.0"
34.58.205.153 - - \[06/Sep/2026:05:40:
...
show less
Bad Web Bot
Web App Attack
2026-09-10 04:11:57
UTC ·
(2 months ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇬🇧
andypiper
2026-09-10 01:02:51
UTC ·
(2 months ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
grassau.com
2026-09-10 00:10:46
UTC ·
(2 months ago)
*Port Scan* detected from 34.58.205.153 (US/United States/Iowa/Council Bluffs/153.205.58.34.bc.googleusercontent.com).
Port Scan
🇩🇪
4server
2026-09-08 03:15:13
UTC ·
(2 months ago)
[TueSep0805:15:09.3064832026][security2:error][pid1015236:tid1015296][client34.58.205.153:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacc ...
show more
[TueSep0805:15:09.3064832026][security2:error][pid1015236:tid1015296][client34.58.205.153:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpanel.subitotraslochi.ch\"][uri\"/wp-config.php~\"][unique_id\"ap99vfRmlvT6pySbvAMQ2AAAAUM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
xmission.com
2026-09-07 07:51:53
UTC ·
(2 months ago)
34.58.205.153 - - [07/Sep/2026:01:51:53 -0600] "GET /backup.zip HTTP/1.1" 404 29269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
34.58.205.153 - - [07/Sep/2026:01:51:53 -0600] "GET /site.zip ...
show more
34.58.205.153 - - [07/Sep/2026:01:51:53 -0600] "GET /backup.zip HTTP/1.1" 404 29269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
34.58.205.153 - - [07/Sep/2026:01:51:53 -0600] "GET /site.zip HTTP/1.1" 404 29269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
34.58.205.153 - - [07/Sep/2026:01:51:53 -0600] "GET /www.zip HTTP/1.1" 404 29269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
...
show less
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-09-06 22:01:02
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-05.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-06 06:06:52
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 02:06:47.236955 2026] [security2:error] [pid 1556:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 02:06:47.236955 2026] [security2:error] [pid 1556:tid 1556] [client 34.58.205.153:58544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lazymanvegan.com"] [uri "/.env.example"] [unique_id "ap0C9w4eLyJDj9ZlFYfYeQAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
zynex
2026-09-06 05:45:35
UTC ·
(2 months ago)
URL Probing: /backup.tar.gz
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 03:50:13
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:50:04.938750 2026] [security2:error] [pid 18013:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:50:04.938750 2026] [security2:error] [pid 18013:tid 18013] [client 34.58.205.153:38204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.martinez-morera.com"] [uri "/.env.bak"] [unique_id "apzi7MM_TYR8WAWVgPuIzAAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-06 03:36:55
UTC ·
(2 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.58.205.153 (US/United States/153.205.58.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
Hacking
2026-09-06 03:26:06
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.old HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.example HTTP/1.1, GET /_ignition/health-check HTTP/1.1, GET /.env.backup HTTP/1.1
Hacking
Web App Attack
2026-09-06 02:55:51
UTC ·
(2 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇩🇪
big-cloud.nl
2026-09-06 02:31:12
UTC ·
(2 months ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 02:30:51
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 22:30:45.605286 2026] [security2:error] [pid 4671:tid 4 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.58.205.153 (153.205.58.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 22:30:45.605286 2026] [security2:error] [pid 4671:tid 4671] [client 34.58.205.153:41510] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sonoranwaterworks.com"] [uri "/.env.production"] [unique_id "apzQVct17w6XWACiKdKR4gAAAHQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack