🇩🇪
wpadm4
2026-09-06 02:41:54
(26 minutes ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 02:38:02
(30 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 22:37:57.500688 2026] [security2:error] [pid 11729:tid 11760] [client 34.142.153.253:34282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fiefblondel.com"] [uri "/.env.save"] [unique_id "apzSBSdCOveZ2ZzsmBk_GgAAAVc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-06 01:50:06
(1 hour ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-06 01:33:48
(1 hour ago)
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4478 "-" "crusade ...
show more
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4478 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4477 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /.env HTTP/1.1" 404 4478 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /wp-config.php.swp HTTP/1.1" 404 4477 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /.env.bak HTTP/1.1" 404 4478 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /.env.production HTTP/1.1" 404 4477 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /_ignition/health-check HTTP/1.1" 404 4477 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /.env.prod HTTP/1.1" 404 4478 "-" "crusader-worker/1.0"
34.142.153.253 - - [06/Sep/2026:03:33:46 +0200] "GET /.env.dev HTTP/1.1" 404 4477 "-" "crusade
show less
Web App Attack
Brute-Force
🇧🇪
voormedia
2026-09-06 00:52:31
(2 hours ago)
Accessed trap at '/.env'
Web App Attack
🇫🇷
dynamix
2026-09-06 00:36:46
(2 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
Octopuce
2026-09-06 00:08:41
(3 hours ago)
Aggressive web search of vulnerable pages: /backup.tar.gz /db.sql /backup.tar /www.zip /database.sql ...
show more
Aggressive web search of vulnerable pages: /backup.tar.gz /db.sql /backup.tar /www.zip /database.sql ...
show less
Web App Attack
🇲🇾
Rizzy
2026-09-06 00:03:28
(3 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:56:28
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:56:19.664285 2026] [security2:error] [pid 27638:tid 27638] [client 34.142.153.253:50338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.shirtzz.com"] [uri "/.env"] [unique_id "apysI94H4KYPcPX7oPUz0AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:09:31
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:09:24.377152 2026] [security2:error] [pid 3411216:tid 3411216] [client 34.142.153.253:36298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerloft.com"] [uri "/wp-config.php.swp"] [unique_id "apyhJLEQ8vmdISiy_UsodQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-05 22:58:02
(4 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-05 22:35:51
(4 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇬🇧
consul.to
2026-09-05 22:18:24
(4 hours ago)
Web attack/malicious scanning detected
Web App Attack
Anonymous
2026-09-05 21:30:26
(5 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-05 21:15:44
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.142.153.253 (253.153.142.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:15:39.519725 2026] [security2:error] [pid 10212:tid 10212] [client 34.142.153.253:59476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gwdailey.indie100.com"] [uri "/wp-config.php~"] [unique_id "apyGe4iyXM6WOJLmHcvEdgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack