2026-08-28 04:35:59
(4 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
barbarella
2026-08-27 20:48:20
(5 days ago)
Multiple (23) times attack on https port 443: Laravel web application framework vulnerability attack ...
show more
Multiple (23) times attack on https port 443: Laravel web application framework vulnerability attack (GET /storage/logs/laravel.log)
22:48:20 Configuration snooping with modified .env.* file (GET /.env.dev)
22:48:20 Configuration snooping with .env file (GET /.env)
22:48:20 Configuration snooping with modified .env.* file (GET /.env.backup)
22:48:20 Configuration snooping with modified .env.* file (GET /.env.old)
22:48:20 Hacking attempt of Wordpress (GET /wp-config.php.swp)
22:48:20 Trying to access Spring Boot Actuator (GET /actuator/configprops)
22:48:20 Configuration snooping with modified .env.* file (GET /.env.example)
22:48:20 Configuration snooping in .env file (GET /env)
show less
Hacking
Web App Attack
🇩🇪
pscriptos
2026-08-27 20:24:07
(5 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
YF
2026-08-27 19:00:13
(5 days ago)
WordPress config file probe
Web App Attack
🇩🇪
big-cloud.nl
2026-08-27 18:25:12
(5 days ago)
Try to access /.env
Web App Attack
2026-08-27 17:07:03
(5 days ago)
Automated web scanner. Requested suspicious paths: /.env.production | /.env.example | /actuator/env ...
show more
Automated web scanner. Requested suspicious paths: /.env.production | /.env.example | /actuator/env | /storage/logs/laravel.log | /.env.save | /.env.dev | /.env.local | /_ignition/health-check | /.env.bak | /.env.prod | /.env.old | /env | /crusader-404-probe | /.env.backup | /actuator/configprops | /.env. UTC: 2026-08-27 16:23:58.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:58:11
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:58:05.527730 2026] [security2:error] [pid 25198:tid 25198] [client 34.133.9.146:53374] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bidsonlineauctions.com"] [uri "/.env.local"] [unique_id "apBsnUtVifGLwj4FXZ4tsAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:40:00
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:39:52.777332 2026] [security2:error] [pid 24152:tid 24152] [client 34.133.9.146:50600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.chaletparkaparts.com.handankoc.net"] [uri "/wp-config.php.bak"] [unique_id "apBoWJtz_A9LA6cpn2gp0gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:07:58
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:07:53.974827 2026] [security2:error] [pid 32389:tid 32389] [client 34.133.9.146:48806] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.slampools.com"] [uri "/.env.production"] [unique_id "apBg2ZF45NV_M94P_x6CwwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-27 15:25:11
(5 days ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php~ (+12 more) | 2026-08-27 15:25 UTC
show less
Hacking
Web App Attack
2026-08-27 15:25:02
(5 days ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 15:22:42
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 11:22:39.245239 2026] [security2:error] [pid 8006:tid 8006] [client 34.133.9.146:54286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.petra.cloudex.link"] [uri "/wp-config.php~"] [unique_id "apBWP7cYMxjhYaDaSY8NjQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-08-27 14:48:07
(5 days ago)
34.133.9.146 - - [27/Aug/2026:22:48:03 +0800] "GET /wp-config.php.bak HTTP/1.1" 200 6670 "-" "crusad ...
show more
34.133.9.146 - - [27/Aug/2026:22:48:03 +0800] "GET /wp-config.php.bak HTTP/1.1" 200 6670 "-" "crusader-worker/1.0"
34.133.9.146 - - [27/Aug/2026:22:48:03 +0800] "GET /wp-config.php~ HTTP/1.1" 200 6670 "-" "crusader-worker/1.0"
34.133.9.146 - - [27/Aug/2026:22:48:06 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 467 "-" "crusader-worker/1.0"
34.133.9.146 - - [27/Aug/2026:22:48:03 +0800] "GET /wp-config.php.swp HTTP/1.1" 200 6670 "-" "crusader-worker/1.0"
34.133.9.146 - - [27/Aug/2026:22:48:06 +0800] "GET /wp-config.php~ HTTP/1.1" 301 461 "-" "crusader-worker/1.0"
34.133.9.146 - - [27/Aug/2026:22:48:06 +0800] "GET /wp-config.php.swp HTTP/1.1" 301 467 "-" "crusader-worker/1.0"
...
show less
Brute-Force
2026-08-27 14:16:12
(5 days ago)
Bot / seems abusive / Apache connections: 34
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 14:11:52
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.133.9.146 (146.9.133.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:11:45.229987 2026] [security2:error] [pid 27032:tid 27032] [client 34.133.9.146:39042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "salsberggroup.com"] [uri "/wp-config.php~"] [unique_id "apBFoQkiFxB-U7RYlPeYVwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack