🇺🇸
TPI-Abuse
2026-09-04 15:16:45
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 11:16:42.217959 2026] [security2:error] [pid 22317:tid 22317] [client 34.19.255.199:54996] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.smilingorc.com"] [uri "/.env.local"] [unique_id "aprg2hW424uVNJY2pk0TAAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 14:16:46
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:16:39.804383 2026] [security2:error] [pid 11902:tid 11902] [client 34.19.255.199:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.swarnar.com"] [uri "/.env.local"] [unique_id "aprSx6JKCOGA_Gd7arRRfgAAAGk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-09-04 13:40:06
(17 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 12:35:10
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 08:35:02.181889 2026] [security2:error] [pid 11145:tid 11152] [client 34.19.255.199:39462] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.heworeblack.com"] [uri "/wp-config.php.swp"] [unique_id "apq69nrzwxXVEFl6VeBmBwAAAQU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
kkw
2026-09-04 12:01:57
(19 hours ago)
[REDACTED] 34.19.255.199 - - [04/Sep/2026:14:01:56 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4544 ...
show more
[REDACTED] 34.19.255.199 - - [04/Sep/2026:14:01:56 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4544 "-" "crusader-worker/1.0"
... (mode: searching http-sensitive-files)
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 11:15:49
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:15:42.480910 2026] [security2:error] [pid 9736:tid 9736] [client 34.19.255.199:35548] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.emeraldhighlands.org"] [uri "/wp-config.php.bak"] [unique_id "apqoXmf2vKo-iXtU1IzLfwAAADA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
KevinNeale
2026-09-04 11:10:51
(20 hours ago)
Fail2Ban recidive block for repeated malicious authentication attempts.
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-04 10:36:40
(20 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php.bak (+12 more) | 2026-09-04 10:36 UTC
show less
Hacking
Web App Attack
🇳🇱
e.fierstra
2026-09-04 10:18:06
(21 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-04 10:09:31
(21 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:00:07
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.255.199 (199.255.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 05:59:56.804931 2026] [security2:error] [pid 12537:tid 12537] [client 34.19.255.199:41444] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.l39capital.com"] [uri "/.env.backup"] [unique_id "apqWnI0r0krPpXOXu4NB1QAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-04 08:03:34
(23 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
mondor.ro
2026-09-04 07:48:35
(23 hours ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.19.255.199, Reason: ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.19.255.199, Reason:[(mod_security) mod_security (id:210730) triggered by 34.19.255.199 (CA/Canada/199.255.19.34.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
🇫🇮
000rosiu
2026-09-04 07:35:58
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from CA.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpo ...
show more
Triggered Cloudflare WAF (firewallManaged) from CA.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /wp-config.php.bak | UA: crusader-worker/1.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇱
WeCloudit-Anti-Abuse
2026-09-04 07:24:41
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
