🇺🇸
xxkodedxx
2026-06-15 14:16:13
(7 hours ago)
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 332× edge-block in ...
show more
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 332× edge-block in 10m window.
Origin: US / AS396982 Google LLC
Active: 14:15:50→14:15:53 UTC
Volume: 332 HTTP req
Probed: /deploy/.env, /services/.env, /api/.env.staging, /server/.env.backup, /stage/.env
Status mix: 444×166 400×166
Vhost fishing: 67.217.240.72
UA: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-15 09:42:29
(12 hours ago)
Excessive multi-domain requests
Brute-Force
🇨🇭
zynex
2026-06-15 08:40:10
(13 hours ago)
URL Probing: /.env
Web App Attack
2026-06-15 06:10:10
(15 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 05:43:17
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.85.170.230 (230.170.85.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.170.230 (230.170.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 01:43:13.604992 2026] [security2:error] [pid 26562:tid 26562] [client 34.85.170.230:41900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.playerpianosupplies.com.player-care.com"] [uri "/.env.uat"] [unique_id "ai-Q8ZZbpWcsUPuk8iM-igAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-15 03:45:00
(18 hours ago)
{"level":"info","ts":1781495098.8000367,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781495098.8000367,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.85.170.230","remote_port":"50768","client_ip":"34.85.170.230","proto":"HTTP/1.1","method":"GET","host":"status.vinyl-41.de","uri":"/.env.example","headers":{"Connection":["close"],"User-Agent":["Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.7.3) Gecko/20040924 Epiphany/1.4.4 (Ubuntu)"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.vinyl-41.de","ech":false}},"bytes_read":0,"user_id":"","duration":0.000061317,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1781495098.8022826,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.85.170.230","remote_port":"50808","client_ip":"34.85.170.230","proto":"HTTP/1.1","method":"GET","host":"status.vinyl-41.de","uri
...
show less
DDoS Attack
Web App Attack
🇨🇭
Ribeye375
2026-06-15 03:44:52
(18 hours ago)
HIPS web-exfiltration - Block tcp/0:65535
Web App Attack
🇩🇪
pscriptos
2026-06-15 03:02:10
(19 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
mnsf
2026-06-15 02:06:30
(19 hours ago)
Abuse Detected (57)
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-06-15 02:04:19
(19 hours ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.85.170.230 (US/United States/230.170. ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.85.170.230 (US/United States/230.170.85.34.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.85.170.230 - - [15/Jun/2026:04:04:16 +0200] "GET /config/sendgrid.env HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" "-" host=www.fondazioneilcireneo.it
34.85.170.230 - - [15/Jun/2026:04:04:16 +0200] "GET /mailer/sendgrid.env HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36" "-" host=www.fondazioneilcireneo.it
show less
Port Scan
🇩🇪
grassau.com
2026-06-14 22:31:48
(23 hours ago)
*Port Scan* detected from 34.85.170.230 (US/United States/District of Columbia/Washington/230.170.85 ...
show more
*Port Scan* detected from 34.85.170.230 (US/United States/District of Columbia/Washington/230.170.85.34.bc.googleusercontent.com).
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-14 22:16:42
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.85.170.230 (230.170.85.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.170.230 (230.170.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:16:35.633641 2026] [security2:error] [pid 20001:tid 20001] [client 34.85.170.230:35388] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "idledog.abbeygardensllandudno.com"] [uri "/.env.local"] [unique_id "ai8oQ8-XCnCA9Xr3wN6dHQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-14 19:01:04
(1 day ago)
20 attempts against mh-misbehave-ban on moon
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-14 14:11:15
(1 day ago)
Multiple WAF Violations
Web App Attack
🇳🇴
jad-abuse
2026-06-14 10:08:44
(1 day ago)
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. O ...
show more
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 161 hits.
show less
Web App Attack