2026-08-28 06:28:08
(2 weeks ago)
Web scanner: GET /@fs/.env.production?raw??
Web App Attack
Hacking
🇦🇹
Erpelstolz
2026-08-28 05:32:16
(2 weeks ago)
VM 131: 34.84.42.246 - - [28/Aug/2026:07:32:16 +0200] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 6205
Hacking
Web App Attack
2026-08-28 05:09:09
(2 weeks ago)
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/.env?raw?? HTTP/1.1" 403 183 "-" "Mozilla/5. ...
show more
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/.env?raw?? HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.7731.23 Safari/537.36; compatible; Twitterbot/1.0"
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/src/.env?raw?? HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; TelegramBot/1.0)"
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 403 183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.1548.86 Safari/537.36; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot"
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1" 403 124 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
34.84.42.246 - - [28/Aug/2026:07:09:09 +0200] "GET /@fs/app/.env?raw?? HTTP/
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-08-28 04:50:12
(2 weeks ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
2026-08-28 04:46:04
(2 weeks ago)
Bot / scanning and/or hacking attempts: GET /api/v1/settings HTTP/1.1, GET /firebase-adminsdk.json H ...
show more
Bot / scanning and/or hacking attempts: GET /api/v1/settings HTTP/1.1, GET /firebase-adminsdk.json HTTP/1.1, GET /wp-config.php.bak HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 04:42:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 00:42:22.832362 2026] [security2:error] [pid 18541:tid 18555] [client 34.84.42.246:62286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lcncmo.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252froot/.env"] [unique_id "apERrmG8VyGirw4uykfj7gAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-08-28 03:59:01
(2 weeks ago)
2026-08-28 05:57:04 GET /@fs/.env.production?raw?? [301] && 2026-08-28 05:57:04 GET /@fs/etc/passwd? ...
show more
2026-08-28 05:57:04 GET /@fs/.env.production?raw?? [301] && 2026-08-28 05:57:04 GET /@fs/etc/passwd?raw?? [301] && 2026-08-28 05:57:04 GET /@fs/src/.env?raw?? [301] && 238 more within 20 minutes
show less
Web App Attack
🇫🇷
masterguru
2026-08-28 03:32:33
(2 weeks ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.84.42.246 (246.42.84.34.bc.googleu ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.84.42.246 (246.42.84.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
show less
Hacking
🇷🇴
iulianh
2026-08-28 02:14:40
(2 weeks ago)
80,443
Brute-Force
SSH
2026-08-28 02:09:42
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 34.84.42.246 (JP/Japan/246.42.84.34.bc. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.84.42.246 (JP/Japan/246.42.84.34.bc.googleusercontent.com)
show less
SQL Injection
🇫🇷
dynamix
2026-08-28 01:59:59
(2 weeks ago)
Multiple WAF Violations
Web App Attack
2026-08-28 01:07:40
(2 weeks ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 00:52:16
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 20:52:09.137864 2026] [security2:error] [pid 5464:tid 5464] [client 34.84.42.246:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.antitribu.com"] [uri "/@fs/app/.env"] [unique_id "apDbueUkeSYkiHBDBOqoMQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-08-28 00:40:01
(2 weeks ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 23:53:03
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.42.246 (246.42.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 19:52:54.590391 2026] [security2:error] [pid 32563:tid 32563] [client 34.84.42.246:12564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.300blockofwarwick.com"] [uri "/@fs/.env"] [unique_id "apDN1kYD2f3ix9YNLTe6GgAAAD8"]
show less
Brute-Force
Bad Web Bot
Web App Attack