2026-09-04 22:37:34
(1 minute ago)
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web se ...
show more
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web server.
show less
Web App Attack
Bad Web Bot
🇬🇧
Buster
2026-09-04 14:29:00
(8 hours ago)
Script kiddie trying to use crusader-worker/1.0 from Perm Blocked ASN and country
Bad Web Bot
Web App Attack
Open Proxy
🇺🇸
TPI-Abuse
2026-09-04 14:10:23
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:10:19.692631 2026] [security2:error] [pid 1486:tid 1486] [client 34.61.236.155:53290] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.guardiancns.com"] [uri "/.env.prod"] [unique_id "aprRS71A45ENMGxuN6h8HgAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-04 13:51:23
(8 hours ago)
[04/Sep/2026:16:51:23 +0300] -- 34.61.236.155 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env ...
show more
[04/Sep/2026:16:51:23 +0300] -- 34.61.236.155 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.prod HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:43:35
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:43:30.648976 2026] [security2:error] [pid 31290:tid 31290] [client 34.61.236.155:41596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "igolfallday.com"] [uri "/wp-config.php~"] [unique_id "aprLAoUvNK1Dss38ljYsQAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-04 13:20:01
(9 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
leasj
2026-09-04 12:50:28
(9 hours ago)
Observed Scanned 12 known-sensitive endpoint(s), e.g.: /.env.local, /.env.production, /.env.prod, /. ...
show more
Observed Scanned 12 known-sensitive endpoint(s), e.g.: /.env.local, /.env.production, /.env.prod, /.env.bak, /.env.old.
show less
Hacking
Bad Web Bot
Web App Attack
2026-09-04 12:46:31
(9 hours ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 12:35:46
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 08:35:40.379347 2026] [security2:error] [pid 11825:tid 11825] [client 34.61.236.155:43264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.uglykid.net"] [uri "/wp-config.php.swp"] [unique_id "apq7HH0ABvMXyJFCUBth3wAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
zynex
2026-09-04 11:53:28
(10 hours ago)
URL Probing: /.env
Web App Attack
2026-09-04 11:24:39
(11 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.61.236.155 (US/United States/155.236.61.3 ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.61.236.155 (US/United States/155.236.61.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.61.236.155 - - [04/Sep/2026:13:24:37 +0200] "GET /.env.bak HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
34.61.236.155 - - [04/Sep/2026:13:24:37 +0200] "GET /.env.local HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
34.61.236.155 - - [04/Sep/2026:13:24:37 +0200] "GET /.env.production HTTP/1.1" 406 4829 "-" "crusader-worker/1.0"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-09-04 11:16:25
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:16:16.430250 2026] [security2:error] [pid 6249:tid 6249] [client 34.61.236.155:56966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "copierswilmington.computersraleigh.com"] [uri "/wp-config.php.bak"] [unique_id "apqogE2qxzeDsq_jYqebuAAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-04 11:10:30
(11 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /wp-config.php~ (+12 more) | 2026-09-04 11:10 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 09:18:05
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 05:17:56.662237 2026] [security2:error] [pid 16745:tid 16745] [client 34.61.236.155:42574] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kinkycouple4u.com"] [uri "/.env.production"] [unique_id "apqMxBx2dClslWZuQqRrmAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 08:31:07
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.61.236.155 (155.236.61.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 04:31:01.471197 2026] [security2:error] [pid 23004:tid 23108] [client 34.61.236.155:51850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.chinookcyclingclub.com"] [uri "/wp-config.php~"] [unique_id "apqBxc4Kl8MzvCwEZxJltQAAAII"]
show less
Brute-Force
Bad Web Bot
Web App Attack
