🇳🇱
tmiland
2026-09-05 07:21:48
(12 hours ago)
(nginx_404) Dot directory Honeypot Trap 34.97.58.0 (JP/Japan/0.58.97.34.bc.googleusercontent.com): 2 ...
show more
(nginx_404) Dot directory Honeypot Trap 34.97.58.0 (JP/Japan/0.58.97.34.bc.googleusercontent.com): 2 in the last 3600 secs; IP: 34.97.58.0; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.97.58.0 - - [05/Sep/2026:09:21:44 +0200] "GET /.env.backup HTTP/1.1" 404 2992 "-" "crusader-worker/1.0" 34.97.58.0 - - [05/Sep/2026:09:21:44 +0200] "GET /.env.example HTTP/1.1" 404 2992 "-" "crusader-worker/1.0"
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-04 15:19:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 11:19:49.452914 2026] [security2:error] [pid 8830:tid 8830] [client 34.97.58.0:43450] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.unilabkenya.com"] [uri "/.env.production"] [unique_id "aprhlXHPivG5F6jA2zJoTwAAAGg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-04 14:38:23
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇷🇴
iulianh
2026-09-04 13:33:19
(1 day ago)
80,443
Brute-Force
SSH
🇫🇷
Baking333
2026-09-04 11:50:06
(1 day ago)
[redacted] 34.97.58.0 - - [04/Sep/2026:12:50:03 +0100] "GET /.[redacted] HTTP/1.1" 307 5690 "-" "cru ...
show more
[redacted] 34.97.58.0 - - [04/Sep/2026:12:50:03 +0100] "GET /.[redacted] HTTP/1.1" 307 5690 "-" "crusader-worker/1.0" [redacted] 34.97.58.0 - - [04/Sep/2026:12:50:03 +0100] "GET /.[redacted] HTTP/1.1" 307 5690 "-" "crusader-worker/1.0"
show less
Bad Web Bot
Web App Attack
🇫🇷
mail.avx.gr
2026-09-04 10:43:02
(1 day ago)
(nginxENVSCAN) nginx environment-file scanner detected from 34.97.58.0 (JP/Japan/Osaka/Osaka/0.58.97 ...
show more
(nginxENVSCAN) nginx environment-file scanner detected from 34.97.58.0 (JP/Japan/Osaka/Osaka/0.58.97.34.bc.googleusercontent.com)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-04 09:22:11
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 05:22:07.458825 2026] [security2:error] [pid 438067:tid 438067] [client 34.97.58.0:57414] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lyndon.stamford.org"] [uri "/.env"] [unique_id "apqNvywzb7qVlCdG8o0GHAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-04 08:57:06
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-04 08:54:52
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 08:44:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:44:13.614265 2026] [security2:error] [pid 7628:tid 7628] [client 34.97.58.0:50828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rotarymagnetics.com"] [uri "/.env.local"] [unique_id "apqE3e1ctSzZym-6vELThQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 08:29:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:29:02.745073 2026] [security2:error] [pid 16783:tid 16783] [client 34.97.58.0:48222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.m2oblivion.com"] [uri "/.env.save"] [unique_id "apqBTmLEvCEa03iVtV9cXgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyt
2026-09-04 08:21:46
(1 day ago)
Sensitive File Probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 08:08:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:08:42.328660 2026] [security2:error] [pid 11625:tid 11625] [client 34.97.58.0:51016] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dojoonthego.com"] [uri "/.env.prod"] [unique_id "app8ipZjnYL0MjFW1ENcAgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-04 08:05:02
(1 day ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 07:52:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 34.97.58.0 (0.58.97.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 03:52:19.256901 2026] [security2:error] [pid 11629:tid 11629] [client 34.97.58.0:52264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.ronelgas.com"] [uri "/wp-config.php.swp"] [unique_id "app4s5sT7yX79PLIoKliVwAAADs"]
show less
Brute-Force
Bad Web Bot
Web App Attack