🇺🇸
cwytech
2026-09-06 06:08:19
(1 hour ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-sensitive-files.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 03:02:54
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:02:48.010304 2026] [security2:error] [pid 257599:tid 257630] [client 34.146.132.28:38098] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wijaya.biz"] [uri "/wp-config.php.bak"] [unique_id "apzX2B6CKJg02Y_H8XxWCgAAARE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-09-06 02:32:50
(5 hours ago)
34.146.132.28 - - [06/Sep/2026:05:32:50 +0300] "GET /_ignition/health-check HTTP/2.0" 301 281 "-" "c ...
show more
34.146.132.28 - - [06/Sep/2026:05:32:50 +0300] "GET /_ignition/health-check HTTP/2.0" 301 281 "-" "crusader-worker/1.0"
34.146.132.28 - - [06/Sep/2026:05:32:50 +0300] "GET /actuator/configprops HTTP/2.0" 301 281 "-" "crusader-worker/1.0"
...
show less
Web App Attack
2026-09-06 02:00:59
(5 hours ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
2026-09-06 01:43:39
(5 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-09-06 01:29:46
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:29:38.130919 2026] [security2:error] [pid 22626:tid 22626] [client 34.146.132.28:38226] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "foothillsjasper.jaspercity.com"] [uri "/.env"] [unique_id "apzCAv91j32xNv8KxqzlKAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 01:12:45
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:12:37.676211 2026] [security2:error] [pid 29208:tid 29208] [client 34.146.132.28:42578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bikinipageone.com"] [uri "/.htaccess"] [unique_id "apy-BVY4yxPRuI7uvu_18QAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-09-06 01:00:17
(6 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 00:49:13
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.132.28 (28.132.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:49:05.341662 2026] [security2:error] [pid 32565:tid 32565] [client 34.146.132.28:50880] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "emelecsrl.com"] [uri "/.env.backup"] [unique_id "apy4gZUyhJ9CQAxHNtlYGwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-06 00:16:39
(7 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php.swp (+12 more) | 2026-09-06 00:16 UTC
show less
Hacking
Web App Attack
🇮🇳
evicky2002
2026-09-06 00:02:40
(7 hours ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
e.fierstra
2026-09-05 23:42:53
(7 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-05 22:59:57
(8 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
pscriptos
2026-09-05 22:50:09
(8 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇨🇭
zynex
2026-09-05 22:32:51
(9 hours ago)
URL Probing: /wp-config.php~
Web App Attack
