🇿🇦
conure.sh
2026-09-23 12:13:50
UTC ·
(1 month ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 0s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:54:21
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:54:17.259654 2026] [security2:error] [pid 23822:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:54:17.259654 2026] [security2:error] [pid 23822:tid 23822] [client 34.20.214.180:38008] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sandbox.davis.monster"] [uri "/.env.old"] [unique_id "arKyuSvJkFnQO2TMVXBqNwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:34:09
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:34:02.461329 2026] [security2:error] [pid 13385:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:34:02.461329 2026] [security2:error] [pid 13385:tid 13385] [client 34.20.214.180:55136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "radiantmessages.com"] [uri "/wp-config.php~"] [unique_id "arKt-hLebSYyDi--DyUVcgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-09-22 16:19:23
UTC ·
(1 month ago)
{"level":"info","ts":1790091458.7389493,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.20.214.180","remote_port":"37866","client_ip":"34.20.214.180","proto":"HTTP/1.1","method":"GET","host":"nmponmlknmlkjihgc7402a9 ...
show more
{"level":"info","ts":1790091458.7389493,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.20.214.180","remote_port":"37866","client_ip":"34.20.214.180","proto":"HTTP/1.1","method":"GET","host":"nmponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.backup","headers":{"User-Agent":["crusader-worker/1.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.000053021,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://nmponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.env.backup"],"Content-Type":[]}}
{"level":"info","ts":1790091458.7898145,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.20.214.180","remote_port":"37880","client_ip":"34.20.214.180","proto":"HTTP/1.1","method":"GET","host":"nmponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.local","headers":
...
show less
DDoS Attack
Web App Attack
🇺🇸
mccsoft.io
2026-09-22 16:18:04
UTC ·
(1 month ago)
Web application attack / vulnerability scanning. Source sent 32 HTTP request(s) (17 distinct paths) to our public nginx web server on TCP 80/443, probing blocked/sensitive paths; all returned HTTP 444 (connection closed by security rule, jail nginx-4 ...
show more
Web application attack / vulnerability scanning. Source sent 32 HTTP request(s) (17 distinct paths) to our public nginx web server on TCP 80/443, probing blocked/sensitive paths; all returned HTTP 444 (connection closed by security rule, jail nginx-444). Sample requests: GET /actuator/configprops | GET /actuator/env | GET /.env | GET /.env.backup | GET /.env.bak. User-Agent: crusader-worker/1.0. Observed 2026-09-22 16:18:01 UTC. TCP handshake completed (requests fully received). Categories: Web App Attack / Bad Web Bot.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:55:02
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:54:55.243554 2026] [security2:error] [pid 18432:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:54:55.243554 2026] [security2:error] [pid 18432:tid 18432] [client 34.20.214.180:51830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ozkanturker.com"] [uri "/.env"] [unique_id "arKkz_uSeaGeULwgVlazHQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ramazan
2026-09-22 15:53:58
UTC ·
(1 month ago)
Fail2Ban: nginx-4xx | Failures: 10 | Log: /.env /.env.bak /.env.dev /.env.local /.env.production
Web App Attack
Hacking
🇩🇪
pscriptos
2026-09-22 15:41:32
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-22 15:27:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:27:29.731506 2026] [security2:error] [pid 430:tid 43 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:27:29.731506 2026] [security2:error] [pid 430:tid 430] [client 34.20.214.180:60044] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mywhisperkids.com"] [uri "/.env.old"] [unique_id "arKeYe0yydNuvOcEshLYjQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:03:41
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:03:37.908822 2026] [security2:error] [pid 3541:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:03:37.908822 2026] [security2:error] [pid 3541:tid 3541] [client 34.20.214.180:36384] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mayflowersgifts.com"] [uri "/wp-config.php.swp"] [unique_id "arKYySxTYKwd8ENWMr5UawAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-22 13:55:10
UTC ·
(1 month ago)
Multiple WAF Violations
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-22 13:44:23
UTC ·
(1 month ago)
[22/Sep/2026:16:44:23 +0300] -- 34.20.214.180 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /wp-config.php.bak HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:11:24
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:11:19.775786 2026] [security2:error] [pid 28862:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.20.214.180 (180.214.20.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:11:19.775786 2026] [security2:error] [pid 28862:tid 28862] [client 34.20.214.180:57040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flutetroupeofyakima.org"] [uri "/wp-config.php~"] [unique_id "arJ-dzjZgk2DjfUcoQYNSwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-22 12:05:16
UTC ·
(1 month ago)
Scanning/Probing (18)
Brute-Force
Web App Attack
2026-09-22 11:01:00
UTC ·
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
