🇫🇮
JRID
2026-09-03 09:43:32
(1 hour ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
🇫🇮
JRID
2026-09-02 09:42:10
(1 day ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
🇳🇱
Cloud86 B.V.
2026-09-02 04:52:02
(1 day ago)
categories: DDoS Attack
DDoS Attack
🇺🇸
TPI-Abuse
2026-09-01 13:47:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:47:45.299031 2026] [security2:error] [pid 11775:tid 11775] [client 34.39.141.177:35450] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.alexscollay.com"] [uri "/wp-config.php~"] [unique_id "apbXgQphi4eMaY0MxNzjQwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 13:45:33
(1 day ago)
Observed scanned 12 known-sensitive endpoint(s), e.g.: /, /%2eenv, /.ENV, /.env, /.env.bak, /.env.ol ...
show more
Observed scanned 12 known-sensitive endpoint(s), e.g.: /, /%2eenv, /.ENV, /.env, /.env.bak, /.env.old
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 11:20:44
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:20:38.244067 2026] [security2:error] [pid 27665:tid 27665] [client 34.39.141.177:38884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.woodsoninsuranceagency.com"] [uri "/wp-config.php.swp"] [unique_id "apa1BpP0FH0ZInhY-7kWlgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 11:03:54
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:03:46.912007 2026] [security2:error] [pid 309:tid 309] [client 34.39.141.177:46676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.grieve.tv"] [uri "/wp-config.php~"] [unique_id "apaxEnfgh0ePkJP7VG9qKQAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-01 10:29:38
(2 days ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇫🇮
JRID
2026-09-01 09:41:23
(2 days ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
🇫🇷
Feelautom
2026-09-01 09:35:08
(2 days ago)
[FeelAutom Auto-Ban] PathScan: /.env.prod (Score: 202)
Port Scan
🇺🇸
TPI-Abuse
2026-09-01 09:22:18
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:22:14.804991 2026] [security2:error] [pid 226453:tid 226504] [client 34.39.141.177:53768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coheteverde.com"] [uri "/.env.backup"] [unique_id "apaZRrXrnWkgbzFp5H70OwAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-01 08:28:01
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
2026-09-01 08:16:06
(2 days ago)
34.39.141.177 - - [01/Sep/2026:08:16:06 +0000] "GET /.env.production HTTP/1.1" 404 4319 "-" "crusade ...
show more
34.39.141.177 - - [01/Sep/2026:08:16:06 +0000] "GET /.env.production HTTP/1.1" 404 4319 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-09-01 07:14:39
(2 days ago)
Repeated requests for suspicious nonexistent URLs, for example: /.env.save (HTTP port 443)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 06:31:41
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.39.141.177 (177.141.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:31:32.269143 2026] [security2:error] [pid 25745:tid 25750] [client 34.39.141.177:54458] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "streamwriters.com.hdtv55.com"] [uri "/.env.backup"] [unique_id "apZxRIBdI55s7-WYQ1o2QAAAAQM"]
show less
Brute-Force
Bad Web Bot
Web App Attack