2026-09-22 01:10:06
UTC ·
(1 month ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
🇫🇷
✨
2026-09-22 00:12:09
UTC ·
(1 month ago)
Domain : hakuna-matata-rescue.org.uk
Rule : hack
2026-09-22 00:10:19 ***hidden-privacy*** GET /.codex/auth.json.bak - 443 - 34.153.152.67 HTTP/1.1 crusader-worker/1.0 - hakuna-matata-rescue.org.uk 301 0 0 479 119 3 - -
Hacking
SQL Injection
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-09-21 23:15:39
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-21 22:26:06
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.153.152.67 (67.152.153.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 18:26:01.580490 2026] [security2:error] [pid 29352:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 34.153.152.67 (67.152.153.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 18:26:01.580490 2026] [security2:error] [pid 29352:tid 29352] [client 34.153.152.67:51874] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||partybusesflint.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "partybusesflint.com"] [uri "/.codex/auth.json.old"] [unique_id "arGu-bS4_SmHluH2Tv6i_AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-21 19:03:49
UTC ·
(1 month ago)
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please ...
show more
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /.codex/config.toml (+9 more) | 2026-09-21 19:03 UTC
show less
Hacking
Web App Attack
🇬🇧
consul.to
2026-09-21 16:18:25
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
mnsf
2026-09-21 10:05:21
UTC ·
(1 month ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-09-21 09:45:03
UTC ·
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇮
000rosiu
2026-09-21 09:19:40
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from GB.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.codex/auth.json | UA: crusader-worker/1.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇵🇱
sefinek.net
2026-09-21 08:12:54
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from GB.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /app/.claude/credentials.json | UA: crusader-worker/1.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇳🇱
Alt255
2026-09-21 07:47:43
UTC ·
(1 month ago)
[ti-07al] Excessive 404 errors (web scanning): 41 suspicious requests detected by fail2ban jail apache-404. Example: 34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /www/.codex/auth.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - ...
show more
[ti-07al] Excessive 404 errors (web scanning): 41 suspicious requests detected by fail2ban jail apache-404. Example: 34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /www/.codex/auth.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /old/.claude/credentials.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /html/.claude.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /www/.claude/credentials.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /html/.codex/auth.json HTTP/1.1" 404 363 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:09:47:38 +0200] "GET /app/.codex/auth.json HTTP/1.1
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-21 05:50:13
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-21 05:48:51
UTC ·
(1 month ago)
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /config/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /site/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152 ...
show more
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /config/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /site/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /htdocs/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /wwwroot/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /home/.codex/auth.json HTTP/1.1" 404 462 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +0200] "GET /root/.codex/auth.json HTTP/1.1" 404 785 "-" "crusader-worker/1.0"
34.153.152.67 - - [21/Sep/2026:07:48:47 +02
show less
Bad Web Bot
🇺🇸
dot.mg
2026-09-21 03:25:04
UTC ·
(1 month ago)
Scan of vulnerable files
Web App Attack
