🇺🇸
TPI-Abuse
2026-08-29 03:34:24
(34 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 23:34:18.482685 2026] [security2:error] [pid 20273:tid 20273] [client 34.148.40.243:37346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.asiancommoditiescorporation.com"] [uri "/.env.dev"] [unique_id "apJTOqwxIaaN-srjIUiSFAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dbmwebdesign
2026-08-29 02:45:06
(1 hour ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 02:41:18
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:41:12.155150 2026] [security2:error] [pid 25866:tid 25866] [client 34.148.40.243:37956] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "boat-registration-turkey.com"] [uri "/wp-config.php.swp"] [unique_id "apJGyNdaptTnqJX8yQfMjQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-08-29 01:50:02
(2 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇩🇪
SCHAPPY
2026-08-29 01:25:56
(2 hours ago)
Malicious activity from IP detected: crowdsecurity/http-sensitive-files.
Web App Attack
Hacking
🇨🇦
Not Fake
2026-08-29 00:59:54
(3 hours ago)
$f2bV_matches
Web App Attack
🇷🇺
ago.su
2026-08-29 00:59:40
(3 hours ago)
F2B blocked nginx bad bot [otd]
Hacking
Web App Attack
🇺🇸
1gz
2026-08-29 00:53:36
(3 hours ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET meth ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.swp
UA: crusader-worker/1.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-29 00:06:28
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 20:06:23.064134 2026] [security2:error] [pid 5246:tid 5246] [client 34.148.40.243:36440] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "moonstonenightclub.com"] [uri "/.env.old"] [unique_id "apIif3_f8WCm9WM8DcK74wAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-08-28 23:52:50
(4 hours ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.148.40.243 (US/United States/243.40.148.34. ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 34.148.40.243 (US/United States/243.40.148.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/08/29 01:52:47 [error] 1834160#1834160: *866362 access forbidden by rule, client: 34.148.40.243, server: samitecnopetrol.it, request: "GET /wp-config.php~ HTTP/1.1", host: "samitecnopetrol.com"
2026/08/29 01:52:47 [error] 1834163#1834163: *866367 access forbidden by rule, client: 34.148.40.243, server: samitecnopetrol.it, request: "GET /wp-config.php.swp HTTP/1.1", host: "samitecnopetrol.com"
2026/08/29 01:52:47 [error] 1834173#1834173: *866372 access forbidden by rule, client: 34.148.40.243, server: samitecnopetrol.it, request: "GET /wp-config.php.bak HTTP/1.1", host: "samitecnopetrol.com"
show less
Port Scan
🇩🇪
LRob
2026-08-28 23:39:17
(4 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.dev (+12 more) | 2026-08-28 23:39 UTC
show less
Hacking
Web App Attack
🇳🇿
Tripwire
2026-08-28 23:28:23
(4 hours ago)
Scanning for exploits - /.env.save
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 23:11:43
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (243.40.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:11:38.684267 2026] [security2:error] [pid 8836:tid 8836] [client 34.148.40.243:59242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jimhermelband.com"] [uri "/.env.dev"] [unique_id "apIVqnPGOigXhxHQka271AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Apache
2026-08-28 23:08:56
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (US/United States/243.40.148.34.b ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.40.243 (US/United States/243.40.148.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
show less
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-08-28 23:00:00
(5 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack