🇳🇱
Site.eu
2026-09-22 14:36:36
(3 weeks ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
openstrike.co.uk
2026-09-22 05:14:59
(3 weeks ago)
193 attacks on env grabbing URLs, directory traversals, env grabbing URLs (type 2), VC URLs, passwor ...
show more
193 attacks on env grabbing URLs, directory traversals, env grabbing URLs (type 2), VC URLs, password/key grabbing URLs, config grabbing URLs (type 2), PHP URLs:
GET /.env.development HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /.git-credentials HTTP/1.1
GET /env.json HTTP/1.1
POST /icecoder/lib/terminal-xhr.php HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 05:42:41
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:42:36.974300 2026] [security2:error] [pid 15468:tid 15468] [client 34.87.76.110:48352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.divingmachines.com"] [uri "/@fs/app/.env"] [unique_id "arDDzObLyrX1YsARqKu2hwAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 05:03:21
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:03:15.319871 2026] [security2:error] [pid 15803:tid 15803] [client 34.87.76.110:46254] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mumawvickers.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mumawvickers.com"] [uri "/z9x8c7v6b5-debug-trigger-mumawvickers.com"] [unique_id "arC6k56JrjYBVG9dl6wLngAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-09-21 04:41:36
(4 weeks ago)
Scanning for web/db/file exploits on www.dma-fashionshop.com
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
wbsouza
2026-09-21 03:27:50
(4 weeks ago)
CrowdSec: crowdsecurity/http-probing — automated firewall drops on self-hosted IDS sensor
Hacking
🇺🇸
TPI-Abuse
2026-09-21 02:41:28
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:41:23.647086 2026] [security2:error] [pid 29029:tid 29053] [client 34.87.76.110:34674] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.djkirby.com"] [uri "/@fs/app/.env"] [unique_id "arCZU9r9YfNGClvBVBry5AAAAJY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-09-21 02:24:20
(4 weeks ago)
(y3) Failed access -byebye- from 34.87.76.110 (SG/Singapore/110.76.87.34.bc.googleusercontent.com): ...
show more
(y3) Failed access -byebye- from 34.87.76.110 (SG/Singapore/110.76.87.34.bc.googleusercontent.com): (CF_ENABLE)
show less
Hacking
🇫🇷
masterguru
2026-09-21 02:19:40
(4 weeks ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-197)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-20 22:34:45
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 18:34:42.637205 2026] [security2:error] [pid 4455:tid 4455] [client 34.87.76.110:40976] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||diselet.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "diselet.com"] [uri "/z9x8c7v6b5-debug-trigger-diselet.com"] [unique_id "arBfgnRxf6uISPVLVZxVLQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 21:36:45
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:36:37.407154 2026] [security2:error] [pid 21933:tid 21933] [client 34.87.76.110:33894] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "badgerkelley.com"] [uri "/services/.env"] [unique_id "arBR5aiNeTqV-Zjep9toLQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 20:56:13
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.87.76.110 (110.76.87.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 16:56:07.037350 2026] [security2:error] [pid 5725:tid 5725] [client 34.87.76.110:43060] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "discountweddingnapkins.com"] [uri "/client/.env"] [unique_id "arBIZ_0QXg8T9npzea85OQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 20:09:31
(4 weeks ago)
IP matched detection query many 3xx errors.
Brute-Force
2026-09-20 19:24:20
(4 weeks ago)
Aggressive web scan
Web App Attack
🇨🇭
backslash
2026-09-20 19:21:01
(4 weeks ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
