🇩🇪
IVski.com
2026-10-21 04:10:00
(5 days ago)
IVski WAF | Sensitive file probe detected - looking for .env
Hacking
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-19 22:21:54
(1 week ago)
Brute-Force
Web App Attack
🇩🇪
IVski.com
2026-10-19 11:34:55
(1 week ago)
IVski WAF | Router admin login probe
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 06:41:25
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.80.23.117 (117.23.80.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.23.117 (117.23.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 02:41:19.544594 2026] [security2:error] [pid 9703:tid 9703] [client 34.80.23.117:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "goalsnet.net"] [uri "/.env.preprod"] [unique_id "atW7j1nFiUcJC4h2GhoNigAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-10-19 06:00:23
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-19 05:45:51
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.80.23.117 (117.23.80.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.80.23.117 (117.23.80.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 01:45:43.111302 2026] [security2:error] [pid 7631:tid 7631] [client 34.80.23.117:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.earscript.net"] [uri "/files../.env"] [unique_id "atWuhzwwDcBeQJP8Q1GPggAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-19 04:19:01
(1 week ago)
Suspicious URL access.
Hacking
🇬🇧
ProCleanerUK
2026-10-19 04:15:38
(1 week ago)
Honeypot hit on ServiceOS: /api/graphql (UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 ( ...
show more
Honeypot hit on ServiceOS: /api/graphql (UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36)
show less
Web App Attack
Bad Web Bot
🇩🇪
macrob
2026-10-19 02:29:31
(1 week ago)
2026/10/19 02:29:29 [error] 1850000#1850000: *13154251 access forbidden by rule, client: 34.80.23.11 ...
show more
2026/10/19 02:29:29 [error] 1850000#1850000: *13154251 access forbidden by rule, client: 34.80.23.117, server: bin-spin.com, request: "GET /dist/.vite/manifest.json HTTP/1.1", host: "bin-spin.com"
2026/10/19 02:29:29 [error] 1849998#1849998: *13154254 access forbidden by rule, client: 34.80.23.117, server: bin-spin.com, request: "GET /.vite/manifest.json HTTP/1.1", host: "bin-spin.com"
2026/10/19 02:29:29 [error] 1849998#1849998: *13154263 access forbidden by rule, client: 34.80.23.117, server: bin-spin.com, request: "GET /api/orders/..%2fadmin/config.json HTTP/1.1", host: "bin-spin.com"
...
show less
Web App Attack
🇫🇮
Christopher Hughes
2026-10-19 01:48:52
(1 week ago)
34.80.23.117 - - [19/Oct/2026:02:48:52 +0100] "GET /client/.env HTTP/2.0" 401 410 "-" "Mozilla/5.0 ( ...
show more
34.80.23.117 - - [19/Oct/2026:02:48:52 +0100] "GET /client/.env HTTP/2.0" 401 410 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇫🇮
YF
2026-10-19 01:30:39
(1 week ago)
404 errors Vulnerability scan
Web App Attack
🇩🇪
findlab
2026-10-19 00:30:03
(1 week ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇫🇷
Stara
2026-10-18 23:58:04
(1 week ago)
ModSecurity detected web attack - .env/config probing or SQLi/Code injection (Rule 949110)
Brute-Force
Hacking
Web App Attack
🇫🇷
Baking333
2026-10-18 23:01:29
(1 week ago)
[redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET / HTTP/1.1" 200 10892 0/97141 "https:/ ...
show more
[redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET / HTTP/1.1" 200 10892 0/97141 "https://[redacted]/public/.env" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://[redacted]/)" [redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET / HTTP/1.1" 200 10892 0/110930 "https://[redacted]/web/.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@[redacted])" [redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET / HTTP/1.1" 200 10891 0/118448 "https://[redacted]/.[redacted]" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://[redacted]/adsbot"
show less
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-10-18 22:09:15
(1 week ago)
[redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET /.next/.env HTTP/1.1" 302 6741 0/30898 ...
show more
[redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET /.next/.env HTTP/1.1" 302 6741 0/30898 "-" "DuckAssistBot/1.1 (https://[redacted]/duckassistbot)" [redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET /public/.env HTTP/1.1" 302 1499 0/31129 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://[redacted]/)" [redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET /web/.env HTTP/1.1" 302 1499 0/32323 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@[redacted])" [redacted] 34.80.23.117 - - [18/Oct/2026:23:09:14 +0100] "GET /frontend/.env HTTP/1.1" 302 1499 0/53124 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://[redacted]/bot)"
show less
Bad Web Bot
Web App Attack