🇬🇧
Buster
2026-09-01 13:21:00
UTC ·
(2 months ago)
26 WAF violations from Perm Blocked ASN and country - User agent crusader-worker/1.0
Open Proxy
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 09:39:57
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:39:50.025455 2026] [security2:error] [pid 16566:tid 16566] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:39:50.025455 2026] [security2:error] [pid 16566:tid 16566] [client 34.50.9.3:51940] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smtp1.semisysteme.com"] [uri "/.env.production"] [unique_id "apadZhc3B474KxmWCZPrmAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:29:26
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:29:19.438713 2026] [security2:error] [pid 20083:tid 20199] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:29:19.438713 2026] [security2:error] [pid 20083:tid 20199] [client 34.50.9.3:53064] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mailsrv.absurdotron.com"] [uri "/wp-config.php.swp"] [unique_id "apaM33rBwjt5T889PpFmtgAAAIw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
paissangroup
2026-09-01 06:16:03
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 04:39:42
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:39:35.200537 2026] [security2:error] [pid 6868:tid 6868] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:39:35.200537 2026] [security2:error] [pid 6868:tid 6868] [client 34.50.9.3:41998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hotdamnsam.com"] [uri "/wp-config.php.bak"] [unique_id "apZXB-S0jxgVdkCXuaagKwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 03:19:11
UTC ·
(2 months ago)
34.50.9.3 - - [01/Sep/2026:03:19:11 +0000] "GET /.env.bak HTTP/1.1" 403 4013 "-" "crusader-worker/1.0"
...
Bad Web Bot
Web App Attack
🇫🇷
Thibault Millant
2026-09-01 03:16:59
UTC ·
(2 months ago)
34.50.9.3 - - [01/Sep/2026:03:16:39 +0000] "GET /wp-config.php.swp HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
...
Brute-Force
Exploited Host
SSH
🇲🇾
Rizzy
2026-09-01 03:11:12
UTC ·
(2 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇫🇷
Baking333
2026-09-01 02:47:10
UTC ·
(2 months ago)
[redacted] 34.50.9.3 - - [01/Sep/2026:03:47:09 +0100] "GET /.[redacted] HTTP/1.1" 302 6768 0/34706 "-" "crusader-worker/1.0" [redacted] 34.50.9.3 - - [01/Sep/2026:03:47:09 +0100] "GET /.env HTTP/1.1" 302 6768 0/39344 "-" "crusader-worker/1.0" [redact ...
show more
[redacted] 34.50.9.3 - - [01/Sep/2026:03:47:09 +0100] "GET /.[redacted] HTTP/1.1" 302 6768 0/34706 "-" "crusader-worker/1.0" [redacted] 34.50.9.3 - - [01/Sep/2026:03:47:09 +0100] "GET /.env HTTP/1.1" 302 6768 0/39344 "-" "crusader-worker/1.0" [redacted] 34.50.9.3 - - [01/Sep/2026:03:47:09 +0100] "GET /.[redacted] HTTP/1.1" 302 6768 0/35641 "-" "crusader-worker/1.0"
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-01 02:45:43
UTC ·
(2 months ago)
Multiple WAF Violations
Web App Attack
🇮🇪
AutosOnShow
2026-09-01 02:35:05
UTC ·
(2 months ago)
blocked for webapp attack | path requested: / | seen at 2026-09-01 02:34:34.149 |
Web App Attack
🇧🇪
Saec
2026-09-01 02:28:01
UTC ·
(2 months ago)
Jarvis auto-ban: CF top attacker on saec.me (26 hits, KR)
Port Scan
Web App Attack
🇩🇪
srtzero
2026-09-01 02:08:44
UTC ·
(2 months ago)
34.50.9.3 - - [01/Sep/2026:04:08:43 +0200] "GET /.env.backup HTTP/1.1" 404 3271 "-" "crusader-worker/1.0"
34.50.9.3 - - [01/Sep/2026:04:08:43 +0200] "GET /.env.prod HTTP/1.1" 404 3271 "-" "crusader-worker/1.0"
34.50.9.3 - - [01/Sep/2026:04:08:43 +020 ...
show more
34.50.9.3 - - [01/Sep/2026:04:08:43 +0200] "GET /.env.backup HTTP/1.1" 404 3271 "-" "crusader-worker/1.0"
34.50.9.3 - - [01/Sep/2026:04:08:43 +0200] "GET /.env.prod HTTP/1.1" 404 3271 "-" "crusader-worker/1.0"
34.50.9.3 - - [01/Sep/2026:04:08:43 +0200] "GET /.env.production HTTP/1.1" 404 3271 "-" "crusader-worker/1.0"
...
show less
Port Scan
Bad Web Bot
Web App Attack
🇬🇧
WebNiraj
2026-09-01 01:29:45
UTC ·
(2 months ago)
(mod_security) mod_security (id:949110) triggered by 34.50.9.3 (KR/South Korea/3.9.50.34.bc.googleusercontent.com): 5 in the last 3600 secs [SIGMA]
Brute-Force
🇺🇸
TPI-Abuse
2026-09-01 01:12:18
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:12:11.699720 2026] [security2:error] [pid 23348:tid 23348] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.9.3 (3.9.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 21:12:11.699720 2026] [security2:error] [pid 23348:tid 23348] [client 34.50.9.3:50646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dick-schoonover.com"] [uri "/.env.backup"] [unique_id "apYma2x2CrB9Ul6Hwh49jQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack