🇬🇧
AvonleaConsulting
2026-09-04 14:48:42
(1 day ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:11:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:11:12.210171 2026] [security2:error] [pid 12587:tid 12587] [client 34.97.114.20:58904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.aspotoftea.com"] [uri "/.env.backup"] [unique_id "aprRgFOB8xokW6f2ZrfdmQAAAHI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-04 14:07:15
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-04 13:41:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:41:16.807704 2026] [security2:error] [pid 30890:tid 30890] [client 34.97.114.20:34032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "underraided.com"] [uri "/.env.local"] [unique_id "aprKfHkIa9wRSJUmEoG3YAAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-09-04 13:24:38
(1 day ago)
.env scanning [BY]
Web App Attack
🇩🇪
todix
2026-09-04 12:56:06
(1 day ago)
WebAttack or semilar from 34.97.114.20
Web App Attack
🇬🇧
consul.to
2026-09-04 12:56:04
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 12:35:58
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 08:35:52.784917 2026] [security2:error] [pid 26529:tid 26529] [client 34.97.114.20:52702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.walkerlady.com"] [uri "/.env.local"] [unique_id "apq7KOyoQhuGQGRd4RDGIAAAAFk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-09-04 12:13:26
(1 day ago)
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4433 "-" "crusader- ...
show more
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4433 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4433 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /.env.backup HTTP/1.1" 404 4432 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /.env.local HTTP/1.1" 404 4432 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /.env HTTP/1.1" 404 4431 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /.env.dev HTTP/1.1" 404 4431 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /.env.prod HTTP/1.1" 404 4431 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /env HTTP/1.1" 404 4430 "-" "crusader-worker/1.0"
34.97.114.20 - - [04/Sep/2026:14:13:24 +0200] "GET /storage/logs/laravel.log HTTP/1.1" 404 4433 "-" "crusader-worker/1.0"
34.97.114.20 - - [
show less
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-09-04 11:46:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:46:09.106390 2026] [security2:error] [pid 14303:tid 14303] [client 34.97.114.20:56858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.cns518.com"] [uri "/.env.bak"] [unique_id "apqvgXy28-1t0R7NcTcTxAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:16:23
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:16:18.119564 2026] [security2:error] [pid 3023:tid 3336] [client 34.97.114.20:40620] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.certificationwiki.com"] [uri "/.env.save"] [unique_id "apqogl5P-R4laH8FBXxF0AAAAQg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 10:57:56
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
paissangroup
2026-09-04 10:36:37
(1 day ago)
Multiple WAF Violations
Web App Attack
🇮🇹
VHosting
2026-09-04 10:25:04
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:16:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.114.20 (20.114.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:16:01.525834 2026] [security2:error] [pid 2888:tid 2888] [client 34.97.114.20:51540] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jonathan.mathewyoung.com"] [uri "/wp-config.php.swp"] [unique_id "apqaYaudM4fP8Tpv0PiRKwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack