🇨🇭
zynex
2026-09-04 14:56:10
(22 hours ago)
URL Probing: /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:48:35
(22 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:48:28.017407 2026] [security2:error] [pid 23002:tid 23025] [client 34.78.243.24:52642] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ccgparquitectos.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ccgparquitectos.com"] [uri "/storage/logs/laravel.log"] [unique_id "apraPMUEohzoiyy4PKUXfQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 14:16:22
(23 hours ago)
Auto-reported by Fail2Ban (NPM-Auth)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:50:09
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:50:06.178170 2026] [security2:error] [pid 30000:tid 30000] [client 34.78.243.24:58464] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adultshop61.net"] [uri "/.env.local"] [unique_id "aprMjvG1evU8tFiuZwoOOwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 12:30:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 08:30:49.628367 2026] [security2:error] [pid 27319:tid 27319] [client 34.78.243.24:46408] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "firingsquadfilms.com"] [uri "/.env"] [unique_id "apq5-cRT_RO4mzzy-5WRLAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-09-04 12:21:49
(1 day ago)
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4416 "-" "crusader- ...
show more
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4416 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4414 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /_ignition/health-check HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /env HTTP/1.1" 404 4416 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /.env HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /.env.bak HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /.env.prod HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /.env.dev HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243.24 - - [04/Sep/2026:14:21:46 +0200] "GET /storage/logs/laravel.log HTTP/1.1" 404 4415 "-" "crusader-worker/1.0"
34.78.243
show less
Web App Attack
Brute-Force
🇸🇪
vaia.cloud
2026-09-04 11:55:04
(1 day ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:49:16
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:49:08.606757 2026] [security2:error] [pid 18968:tid 18968] [client 34.78.243.24:34694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.amosellistonfortheladies.com"] [uri "/.env.dev"] [unique_id "apqwNN_1ZpbagjEd8UWtdQAAAGU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-09-04 10:52:29
(1 day ago)
34.78.243.24 - - [04/Sep/2026:12:52:29 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4617 "-" "crusader- ...
show more
34.78.243.24 - - [04/Sep/2026:12:52:29 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4617 "-" "crusader-worker/1.0" 34.78.243.24 - - [04/Sep/2026:12:52:29 +0200] "GET /actuator/env HTTP/1.1" 404 4617 "-" "crusader-worker/1.0" 34.78.243.24 - - [04/Sep/2026:12:52:29 +0200] "GET /.env.save HTTP/1.1" 404 4617 "-" "crusader-worker/1.0"
show less
Brute-Force
Anonymous
2026-09-04 10:43:04
(1 day ago)
Bot / scanning and/or hacking attempts: GET /wp-config.php.bak HTTP/1.1, GET /crusader-404-probe HTT ...
show more
Bot / scanning and/or hacking attempts: GET /wp-config.php.bak HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /actuator/configprops HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
raph
2026-09-04 10:37:48
(1 day ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-09-04 09:57:14
(1 day ago)
Accessed trap at '/.env'
Web App Attack
🇩🇪
FD-IX
2026-09-04 08:41:45
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 08:40:43
(1 day ago)
Web application attack detected.
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 08:27:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.78.243.24 (24.243.78.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:27:01.125814 2026] [security2:error] [pid 5591:tid 5591] [client 34.78.243.24:53400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.toepferlab.org"] [uri "/.env.save"] [unique_id "apqA1VhGjMbAR8JpuM_TAQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack