🇩🇪
Zydzy
2026-08-31 11:33:25
(14 hours ago)
Automated attack detected. Server: 95.140.154.181. Jail: nginx-exploit.
Web App Attack
🇮🇳
evicky2002
2026-08-31 00:01:03
(1 day ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-08-29 22:00:35
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-28.
show less
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-08-29 12:01:39
(2 days ago)
csagent: score 24.8: 404 noise floor x3, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0 ...
show more
csagent: score 24.8: 404 noise floor x3, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0s
show less
Web App Attack
🇫🇷
ecode hosting
2026-08-29 03:27:08
(2 days ago)
Domain : MailEnable WebMail
Rule : hack
2026-08-29 03:24:55 10.100.1.20 GET /wp-config.php.bak - 443 ...
show more
Domain : MailEnable WebMail
Rule : hack
2026-08-29 03:24:55 10.100.1.20 GET /wp-config.php.bak - 443 - 34.69.99.136 crusader-worker/1.0 - 404 0 64 1541 - -
show less
Hacking
SQL Injection
Brute-Force
🇺🇸
TPI-Abuse
2026-08-29 03:04:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 23:03:58.121918 2026] [security2:error] [pid 3693:tid 3693] [client 34.69.99.136:35512] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "endoperfect.com"] [uri "/wp-config.php.swp"] [unique_id "apJMHl8Z9VVt3dIcbQzz5AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SiyCah
2026-08-29 03:00:02
(2 days ago)
IP banned by fail2ban; banned in jail apache-modsecurity. Report generated by fail2abuseipdb.
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 02:05:35
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:05:28.941824 2026] [security2:error] [pid 29251:tid 29251] [client 34.69.99.136:48524] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "instalatoribucuresti.com"] [uri "/.env.dev"] [unique_id "apI-aD8XMmG-nK5sMHRkTAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 01:32:00
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 21:31:52.346145 2026] [security2:error] [pid 2120:tid 2338] [client 34.69.99.136:56258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pflagabq.org"] [uri "/.env.production"] [unique_id "apI2iLOZHqDU_uHPzh6DOwAAAhI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-29 01:11:58
(3 days ago)
Web vulnerability probing: /storage/logs/laravel.log
Web App Attack
🇬🇧
andypiper
2026-08-29 01:02:24
(3 days ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
Philister11
2026-08-29 00:11:49
(3 days ago)
CrowdSec: crowdsecurity/http-probing (US/AS396982)
Web App Attack
Hacking
🇺🇸
mnsf
2026-08-29 00:08:30
(3 days ago)
Abuse Detected (23)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-29 00:04:15
(3 days ago)
(mod_security) mod_security (id:949110) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:949110) triggered by 34.69.99.136 (136.99.69.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 20:04:08.653032 2026] [security2:error] [pid 27784:tid 27784] [client 34.69.99.136:38174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.789-bid.net.crazycontrols.com"] [uri "/.env.example"] [unique_id "apIh-EB1nLg0_JSXe7MIawAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-08-28 23:59:41
(3 days ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.69.99.136 (US/United States/136.99.69 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.69.99.136 (US/United States/136.99.69.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.69.99.136 - - [29/Aug/2026:01:59:37 +0200] "GET /wp-config.php.bak HTTP/1.1" 200 11923 "-" "crusader-worker/1.0" "-" host=ramsesconsulting.it
show less
Port Scan