🇿🇦
conure.sh
2026-09-01 05:34:44
(23 hours ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 0s
Web App Attack
🇺🇸
brightenfield
2026-09-01 03:57:24
(1 day ago)
Web App Attack
Web App Attack
🇩🇪
FeG Deutschland
2026-09-01 03:34:43
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇩🇪
Starburst SysOp Team
2026-09-01 03:17:06
(1 day ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-nue6-1)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 02:57:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 22:57:03.363556 2026] [security2:error] [pid 19858:tid 19858] [client 34.89.223.179:41610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jean-louisdarville.com"] [uri "/wp-config.php.swp"] [unique_id "apY-_0JkRHD8bR4UDP7HYAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
zynex
2026-09-01 02:51:12
(1 day ago)
URL Probing: /.env
Web App Attack
🇷🇺
DZBOT
2026-09-01 02:50:34
(1 day ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 02:38:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 22:38:11.917835 2026] [security2:error] [pid 21907:tid 21911] [client 34.89.223.179:43302] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.thedowntonstory.com"] [uri "/.env.local"] [unique_id "apY6k25-TbcRZiBD8lwbmQAAAII"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 00:33:44
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 20:33:36.723842 2026] [security2:error] [pid 9943:tid 9943] [client 34.89.223.179:48224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crewspacer.com.coalminer.com"] [uri "/.env.local"] [unique_id "apYdYOmxOx_fBUUxJq0_PQAAAC0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-01 00:27:25
(1 day ago)
[TueSep0102:27:22.7192832026][security2:error][pid3407149:tid3407182][client34.89.223.179:0]ModSecur ...
show more
[TueSep0102:27:22.7192832026][security2:error][pid3407149:tid3407182][client34.89.223.179:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpcontacts.formet.ch\"][uri\"/.env.old\"][unique_id\"apYb6tcv1c0bEMx3HZrlmAAAABU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 00:15:24
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.89.223.179 (179.223.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 20:15:14.480747 2026] [security2:error] [pid 22107:tid 22107] [client 34.89.223.179:35512] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.businessthanksgivingcard.com"] [uri "/.env"] [unique_id "apYZEgGdg0fkdv3Pm_gNSgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-31 23:45:02
(1 day ago)
suspicious request in access.log
Web App Attack
🇬🇧
Aetherweb Ark
2026-08-31 23:38:43
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 34.89.223.179 (DE/Germany/179.223.89.34.bc.goog ...
show more
(mod_security) mod_security (id:949110) triggered by 34.89.223.179 (DE/Germany/179.223.89.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇺🇸
infra-monitor
2026-08-31 23:00:07
(1 day ago)
Automated ban via infra-monitor: suspicious-probe, wordpress-probe, wp-sensitive-paths, +3 more
Port Scan
Web App Attack
🇩🇪
LRob
2026-08-31 22:42:05
(1 day ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.save (+12 more) | 2026-08-31 22:42 UTC
show less
Hacking
Web App Attack