🇳🇱
homeshowdomain.nl
2026-08-28 22:02:31
(49 minutes ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-27.
show less
Web App Attack
SSH
Hacking
🇫🇷
service Informatique
2026-08-28 04:00:37
(18 hours ago)
GET /wp-config
Web App Attack
🇳🇱
JCB
2026-08-27 21:39:00
(1 day ago)
34.121.207.246 - - [27/Aug/2026:14:15:40 +0300] "GET /.env.backup HTTP/1.1" 403 459 "-" "crusader-wo ...
show more
34.121.207.246 - - [27/Aug/2026:14:15:40 +0300] "GET /.env.backup HTTP/1.1" 403 459 "-" "crusader-worker/1.0"
34.121.207.246 - - [27/Aug/2026:14:15:40 +0300] "GET /.env.example HTTP/1.1" 403 459 "-" "crusader-worker/1.0"
...
show less
Web App Attack
Hacking
🇮🇩
Burayot
2026-08-27 21:36:50
(1 day ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 34.121.207.246 (US/United States/246 ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 34.121.207.246 (US/United States/246.207.121.34.bc.googleusercontent.com): 2 in the last 3600 secs
show less
Web App Attack
🇮🇪
AutosOnShow
2026-08-27 21:07:05
(1 day ago)
blocked for webapp attack | path requested: / | seen at 2026-08-27 21:06:21.479 |
Web App Attack
🇧🇾
lns.bz
2026-08-27 20:56:59
(1 day ago)
Too many 404 requests [BY]
Web App Attack
🇳🇱
debestelapp
2026-08-27 20:40:07
(1 day ago)
Web App Attack
🇩🇪
burlacu.org
2026-08-27 20:09:03
(1 day ago)
Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 3 attempts ...
show more
Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 3 attempts. Blocked automatically.
show less
Web App Attack
Bad Web Bot
🇳🇴
jad-abuse
2026-08-27 19:56:04
(1 day ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, scanner_ua, source_backup, actuator, config_backup, ignition_debug. Observed by 1 sensor(s); 38 hits.
show less
Hacking
Web App Attack
🇩🇪
Dominik Lysiak
2026-08-27 19:24:42
(1 day ago)
34.121.207.246 - - [27/Aug/2026:21:24:41 +0200] "GET /.env.bak HTTP/1.1" 200 30194 "-" "crusader-wor ...
show more
34.121.207.246 - - [27/Aug/2026:21:24:41 +0200] "GET /.env.bak HTTP/1.1" 200 30194 "-" "crusader-worker/1.0"
34.121.207.246 - - [27/Aug/2026:21:24:41 +0200] "GET /.env.production HTTP/1.1" 200 30212 "-" "crusader-worker/1.0"
34.121.207.246 - - [27/Aug/2026:21:24:41 +0200] "GET /.env.example HTTP/1.1" 200 30204 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇺🇸
mnsf
2026-08-27 19:05:33
(1 day ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 18:19:59
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.121.207.246 (246.207.121.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.121.207.246 (246.207.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 14:19:51.207732 2026] [security2:error] [pid 1840:tid 1840] [client 34.121.207.246:56192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "surf-sci-eng.com"] [uri "/wp-config.php~"] [unique_id "apB_xyoAcWOjsCB3vckDvgAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 17:40:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.121.207.246 (246.207.121.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.121.207.246 (246.207.121.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 13:40:36.855321 2026] [security2:error] [pid 5199:tid 5199] [client 34.121.207.246:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.vertubet.com"] [uri "/.env.save"] [unique_id "apB2lNveI-DbThwsYxm6eQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
Francisco Vallejo
2026-08-27 16:31:02
(1 day ago)
[Thu Aug 27 18:31:02.715384 2026] [authz_core:error] [pid 480669:tid 140580185175744] [client 34.121 ...
show more
[Thu Aug 27 18:31:02.715384 2026] [authz_core:error] [pid 480669:tid 140580185175744] [client 34.121.207.246:40482] AH01630: client denied by server configuration: proxy:http://localhost:9091/.env.old
[Thu Aug 27 18:31:02.715384 2026] [authz_core:error] [pid 480670:tid 140578616493760] [client 34.121.207.246:40470] AH01630: client denied by server configuration: proxy:http://localhost:9091/actuator/configprops
[Thu Aug 27 18:31:02.715604 2026] [authz_core:error] [pid 480670:tid 140579782522560] [client 34.121.207.246:40518] AH01630: client denied by server configuration: proxy:http://localhost:9091/.env.dev
[Thu Aug 27 18:31:02.715613 2026] [authz_core:error] [pid 480670:tid 140580143212224] [client 34.121.207.246:40454] AH01630: client denied by server configuration: proxy:http://localhost:9091/_ignition/health-check
[Thu Aug 27 18:31:02.720326 2026] [authz_core:error] [pid 480670:tid 140580134819520] [client 34.121.207.246:40532] AH01630: client denied by server configuration: proxy:
...
show less
Brute-Force
SSH
🇫🇷
mrcrassi
2026-08-27 16:30:21
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET meth ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.swp
UA: crusader-worker/1.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot