🇮🇳
evicky2002
2026-08-31 00:01:03
UTC ·
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-08-29 22:00:34
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-28.
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-08-29 12:01:37
UTC ·
(2 months ago)
csagent: score 20.8: 404 noise floor x3, secrets grab x1, wp-config backup grab x1; 1 domain(s) in 0s
Web App Attack
🇭🇺
DumaNet
2026-08-29 03:37:00
UTC ·
(2 months ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 Aug 28. 17:12:41
Source IP: 34.27.145.65
Portion of the log(s):
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /storage/logs/laravel.log HTTP/1.1" 404 153 "-" "crusader-worker/1. ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 Aug 28. 17:12:41
Source IP: 34.27.145.65
Portion of the log(s):
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /storage/logs/laravel.log HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /actuator/configprops HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /wp-config.php~ HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /actuator/env HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /crusader-404-probe HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /.env.local HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /.env.save HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
34.27.145.65 - [28/Aug/2026:17:12:41 +0200] "GET /.env.production HTTP/1.1" 404 153 "-" "crusader-worker/1.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 03:34:39
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 23:34:35.524696 2026] [security2:error] [pid 14162:tid 14 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 23:34:35.524696 2026] [security2:error] [pid 14162:tid 14162] [client 34.27.145.65:40614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blockadegc.com"] [uri "/.env.example"] [unique_id "apJTSxY3OaFELCoOEXBHGgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
v1nc
2026-08-29 02:37:47
UTC ·
(2 months ago)
34.27.145.65 - - [29/Aug/2026:02:37:47 +0000] "GET /wp-config.php.bak HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
...
Hacking
🇩🇪
expandmade.com
2026-08-29 01:32:40
UTC ·
(2 months ago)
trolling for installation vulnerabilities [29/Aug/2026:01:32:39 "GET /actuator/configprops"]
Web App Attack
🇩🇪
FeG Deutschland
2026-08-29 01:03:43
UTC ·
(2 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇫🇮
YF
2026-08-29 00:30:49
UTC ·
(2 months ago)
WordPress config file probe
Web App Attack
🇩🇪
macrob
2026-08-28 23:44:59
UTC ·
(2 months ago)
2026/08/28 23:44:57 [error] 4017414#4017414: *531686325 access forbidden by rule, client: 34.27.145.65, server: binixo.mx, request: "GET /wp-config.php.bak HTTP/1.1", host: "binixo.mx"
2026/08/28 23:44:57 [error] 4017411#4017411: *531686324 access fo ...
show more
2026/08/28 23:44:57 [error] 4017414#4017414: *531686325 access forbidden by rule, client: 34.27.145.65, server: binixo.mx, request: "GET /wp-config.php.bak HTTP/1.1", host: "binixo.mx"
2026/08/28 23:44:57 [error] 4017411#4017411: *531686324 access forbidden by rule, client: 34.27.145.65, server: binixo.mx, request: "GET /.env.old HTTP/1.1", host: "binixo.mx"
2026/08/28 23:44:57 [error] 4017414#4017414: *531686331 access forbidden by rule, client: 34.27.145.65, server: binixo.mx, request: "GET /.env.bak HTTP/1.1", host: "binixo.mx"
...
show less
Web App Attack
🇫🇷
LRob
2026-08-28 23:37:38
UTC ·
(2 months ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: GET | path: /.env.save | 2026-08-28 23:37 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 23:09:51
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:09:44.121851 2026] [security2:error] [pid 29200:tid 29 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:09:44.121851 2026] [security2:error] [pid 29200:tid 29200] [client 34.27.145.65:38574] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "riccardiagency.com"] [uri "/.env.backup"] [unique_id "apIVOB6j_pHZmEmfJMihOAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 22:18:00
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 18:17:58.112881 2026] [security2:error] [pid 3363342:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 18:17:58.112881 2026] [security2:error] [pid 3363342:tid 3363356] [client 34.27.145.65:39816] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.the-aquifer.com.giere.us"] [uri "/.env.local"] [unique_id "apIJFm-f09rsyFsPsuSVQgAAAUQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Ribeye375
2026-08-28 22:12:05
UTC ·
(2 months ago)
HIPS nginx-access-errors - Block tcp/http,https
Brute-Force
🇺🇸
TPI-Abuse
2026-08-28 21:19:10
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 17:19:05.755046 2026] [security2:error] [pid 3138:tid 313 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.27.145.65 (65.145.27.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 17:19:05.755046 2026] [security2:error] [pid 3138:tid 3138] [client 34.27.145.65:50826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ucommsi.com"] [uri "/.env.prod"] [unique_id "apH7SeXeNuCBDf_0ZJYHxQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack