🇵🇱
Woytass
2026-08-28 16:58:17
(44 minutes ago)
CSF/lfd permanent block on srv1.woytas.ovh. Trigger=LF_MODSEC; ports=*; (mod_security) mod_security ...
show more
CSF/lfd permanent block on srv1.woytas.ovh. Trigger=LF_MODSEC; ports=*; (mod_security) mod_security (id:949110) triggered by 34.23.67.61 (US/United States/61.67.23.34.bc.googleusercontent.com): 5 in the last 3600 secs
show less
Web App Attack
🇬🇧
Aetherweb Ark
2026-08-28 15:29:29
(2 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.23.67.61 (US/United States/61.67.23.34.bc.go ...
show more
(mod_security) mod_security (id:949110) triggered by 34.23.67.61 (US/United States/61.67.23.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇺🇸
mnsf
2026-08-28 14:05:17
(3 hours ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
xxkodedxx
2026-08-28 12:48:43
(4 hours ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 23× edge-block ...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get, 23× edge-block in 10m window.
Origin: US / AS396982 Google LLC
Active: 12:48:40 UTC
Volume: 23 HTTP req, 15 honeypot probe(s)
Bait taken: /.env.production, /.env.local, /actuator/env, /env, /.env.backup
Status mix: 444×23
Vhost fishing: secondopinion.ztx-lab.com
UA: "crusader-worker/1.0"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 12:36:54
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.23.67.61 (61.67.23.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.23.67.61 (61.67.23.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 08:36:50.626181 2026] [security2:error] [pid 14825:tid 14825] [client 34.23.67.61:57194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bowdenslandingcom.draindoctor.us"] [uri "/wp-config.php~"] [unique_id "apGA4pCijShwO4YkASq3DwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-08-28 12:14:24
(5 hours ago)
csagent: score 20.5: 404 noise floor x2, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0 ...
show more
csagent: score 20.5: 404 noise floor x2, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0s
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 12:00:53
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.23.67.61 (61.67.23.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.23.67.61 (61.67.23.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 08:00:46.789986 2026] [security2:error] [pid 12962:tid 12962] [client 34.23.67.61:57208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unfinishedepic.com"] [uri "/.env.save"] [unique_id "apF4bkJ74inj5AoLUpHoEgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
6kilowatti
2026-08-28 11:31:00
(6 hours ago)
34.23.67.61 - - [28/Aug/2026:14:30:58 +0300] "GET /.env.local HTTP/1.1" 404 41 "-" "crusader-worker/ ...
show more
34.23.67.61 - - [28/Aug/2026:14:30:58 +0300] "GET /.env.local HTTP/1.1" 404 41 "-" "crusader-worker/1.0"
34.23.67.61 - - [28/Aug/2026:14:30:59 +0300] "GET /wp-config.php.bak HTTP/1.1" 404 41 "-" "crusader-worker/1.0"
...
show less
Web App Attack
🇩🇪
maxpower
2026-08-28 11:23:06
(6 hours ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.23.67.61 (US/United States/61.67.23.3 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.23.67.61 (US/United States/61.67.23.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.23.67.61 - - [28/Aug/2026:13:23:01 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 358 "-" "crusader-worker/1.0" "-" host=mail.brokerleader.it
show less
Port Scan
🇬🇧
consul.to
2026-08-28 10:28:58
(7 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-08-28 04:36:13
(13 hours ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2026-08-27 22:20:05
(19 hours ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
🇮🇳
Starburst SysOp Team
2026-08-27 22:15:39
(19 hours ago)
Attempt to access a backup or working file. Pattern match "\\\\. (920500-bom2-2)
Hacking
🇮🇳
nadnitin
2026-08-27 21:36:24
(20 hours ago)
Automated trigger via Nginx Police. Reason: PATH-PROBER. Trigger Log: 34.23.67.61 - - [28/Aug/2026:0 ...
show more
Automated trigger via Nginx Police. Reason: PATH-PROBER. Trigger Log: 34.23.67.61 - - [28/Aug/2026:03:06:24 +0530] "GET /.env.bak HTTP/1.1" 444 0 "-" "crusader-worker/1.0"
show less
Web App Attack
2026-08-27 20:29:06
(21 hours ago)
fail2ban: Sensitive web probes detected
Web App Attack