🇮🇳
evicky2002
2026-09-09 00:01:20
UTC ·
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-09-08 21:59:46
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-07.
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-09-08 05:14:03
UTC ·
(2 months ago)
258 attacks on config grabbing URLs (type 2), password/key grabbing URLs, env grabbing URLs, env grabbing URLs (type 2), PHP URLs, VC URLs:
GET /appsettings.json HTTP/1.1
GET /id_dsa HTTP/1.1
GET /staging/.env HTTP/1.1
GET /@fs/proc/self/cwd/.azure/c ...
show more
258 attacks on config grabbing URLs (type 2), password/key grabbing URLs, env grabbing URLs, env grabbing URLs (type 2), PHP URLs, VC URLs:
GET /appsettings.json HTTP/1.1
GET /id_dsa HTTP/1.1
GET /staging/.env HTTP/1.1
GET /@fs/proc/self/cwd/.azure/credentials?raw?? HTTP/1.1
GET /i.php HTTP/1.1
GET /.git/config HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
Petros Stefanakis
2026-09-07 10:42:06
UTC ·
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted] 34.63.186.8 (US/United States/8.186.63.34.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-09-07 10:37:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 06:37:28.859867 2026] [security2:error] [pid 19712:tid 1973 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 06:37:28.859867 2026] [security2:error] [pid 19712:tid 19732] [client 34.63.186.8:9050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.moderncabinetcorp.com"] [uri "/@fs/.env.development"] [unique_id "ap6T6OX1ieuV86ogWiVlMwAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 09:57:19
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 05:57:12.421458 2026] [security2:error] [pid 4789:tid 4789] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 05:57:12.421458 2026] [security2:error] [pid 4789:tid 4789] [client 34.63.186.8:26138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sokolskiy.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252fapp/.env"] [unique_id "ap6KeOZGLlmlNND-ZGhL7gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 09:33:41
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 05:33:37.438960 2026] [security2:error] [pid 3974:tid 3974] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 05:33:37.438960 2026] [security2:error] [pid 3974:tid 3974] [client 34.63.186.8:46152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.southshorestreetrods.com"] [uri "/@fs/.env"] [unique_id "ap6E8bW74O-e10bXy6z-SgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-07 09:15:49
UTC ·
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
grassau.com
2026-09-07 08:59:04
UTC ·
(2 months ago)
*Port Scan* detected from 34.63.186.8 (US/United States/Iowa/Council Bluffs/8.186.63.34.bc.googleusercontent.com).
Port Scan
🇺🇸
TPI-Abuse
2026-09-07 08:46:54
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 04:46:51.611892 2026] [security2:error] [pid 5904:tid 5904] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 04:46:51.611892 2026] [security2:error] [pid 5904:tid 5904] [client 34.63.186.8:64388] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.intelerium.com"] [uri "/@fs/../.env"] [unique_id "ap55-xyDNys47ic1gF0jSAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-07 07:58:20
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 03:58:14.400982 2026] [security2:error] [pid 30091:tid 3009 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.63.186.8 (8.186.63.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 03:58:14.400982 2026] [security2:error] [pid 30091:tid 30091] [client 34.63.186.8:4416] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.aoklandco.com"] [uri "/@fs/app/.env"] [unique_id "ap5uls2mAcDvLAMWHWWnCAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-07 07:21:48
UTC ·
(2 months ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-09-07 06:50:09
UTC ·
(2 months ago)
Banned by Fail2Ban on server
Web App Attack
🇧🇪
cmbplf
2026-09-07 06:45:32
UTC ·
(2 months ago)
468 requests with url.path *.azure/*
Brute-Force
Bad Web Bot
2026-09-07 06:43:04
UTC ·
(2 months ago)
[ns65.kdns.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/@fs/app/rootkey.csv?raw?? | /@fs/.env.local?raw?? | /@fs/.env.production?raw??
Hacking
Web App Attack