🇳🇱
e.fierstra
2026-09-01 11:16:28
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇵🇱
mscode.pl
2026-09-01 11:13:52
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Pro ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Zone: wiki.mscode.pl
Endpoint: /wp-config.php.bak
UA: crusader-worker/1.0
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-01 11:08:59
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.139.144.45 (45.144.139.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.139.144.45 (45.144.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:08:52.237805 2026] [security2:error] [pid 24601:tid 24601] [client 34.139.144.45:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.enperth.org"] [uri "/.env.local"] [unique_id "apayRH69TWL159xD6GoGYQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
MatCat
2026-09-01 11:05:10
(1 day ago)
Banned by fail2ban: apache-webprobe
Port Scan
Bad Web Bot
🇩🇪
Hazzard
2026-09-01 10:10:42
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇩🇪
FD-IX
2026-09-01 09:46:16
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-09-01 09:38:13
(1 day ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.env (Match: /.env)
show less
Hacking
Brute-Force
Web App Attack
2026-09-01 09:17:04
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /wp-config.php~ HTTP/1.1
Hacking
Web App Attack
🇸🇪
SkyDancer
2026-09-01 08:43:52
(1 day ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH
2026-09-01 08:30:30
(1 day ago)
34.139.144.45 - - [01/Sep/2026:16:30:30 +0800] "GET /.env.prod HTTP/1.1" 404 196 "-" "crusader-worke ...
show more
34.139.144.45 - - [01/Sep/2026:16:30:30 +0800] "GET /.env.prod HTTP/1.1" 404 196 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇮🇹
clamehost.it
2026-09-01 07:50:18
(1 day ago)
Automatic report - Brute Force attack using this IP address
Brute-Force
🇺🇸
factor1
2026-09-01 07:47:50
(1 day ago)
CrowdSec at saturn Reports Abuse
Web App Attack
2026-09-01 07:15:21
(1 day ago)
Web scanner: GET /.env
Web App Attack
Hacking
🇺🇸
wteiken
2026-09-01 07:06:32
(1 day ago)
2026-09-01T03:06:30.103185-04:00 rocinante.teiken.net kernel: [139038.598309] syn_limit:IN=ens5 OUT= ...
show more
2026-09-01T03:06:30.103185-04:00 rocinante.teiken.net kernel: [139038.598309] syn_limit:IN=ens5 OUT= MAC=0a:ff:cf:a1:a5:bb:0a:f3:ae:05:2f:b7:08:00 SRC=34.139.144.45 DST=192.168.16.119 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=61157 DF PROTO=TCP SPT=59202 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0
2026-09-01T03:06:30.106110-04:00 rocinante.teiken.net kernel: [139038.598363] syn_limit:IN=ens5 OUT= MAC=0a:ff:cf:a1:a5:bb:0a:f3:ae:05:2f:b7:08:00 SRC=34.139.144.45 DST=192.168.16.119 LEN=60 TOS=0x00 PREC=0x60 TTL=58 ID=8773 DF PROTO=TCP SPT=59176 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0
2026-09-01T03:06:30.106177-04:00 rocinante.teiken.net kernel: [139038.600983] syn_limit:IN=ens5 OUT= MAC=0a:ff:cf:a1:a5:bb:0a:f3:ae:05:2f:b7:08:00 SRC=34.139.144.45 DST=192.168.16.119 LEN=60 TOS=0x00 PREC=0x60 TTL=58 ID=26088 DF PROTO=TCP SPT=59204 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0
2026-09-01T03:06:30.106202-04:00 rocinante.teiken.net kernel: [139038.606400] syn_limit:IN=ens5 OUT= MAC=0a:ff:cf:a1:a5:bb:0a:f3
...
show less
Port Scan
🇩🇪
yitzhaq
2026-09-01 07:05:10
(1 day ago)
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4407 "-" "crusader ...
show more
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4407 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4405 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.dev HTTP/1.1" 404 4406 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.backup HTTP/1.1" 404 4406 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.bak HTTP/1.1" 404 4406 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.example HTTP/1.1" 404 4406 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.old HTTP/1.1" 404 4407 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env.save HTTP/1.1" 404 4405 "-" "crusader-worker/1.0"
34.139.144.45 - - [01/Sep/2026:09:05:08 +0200] "GET /.env HTTP/1.1" 404 4406 "-" "crusader-worker/1.0"
34.139.144.45 - -
show less
Web App Attack
Brute-Force