🇩🇪
LRob
2026-09-01 12:47:55
(2 minutes ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.save (+10 more) | 2026-09-01 12:47 UTC
show less
Hacking
Web App Attack
2026-09-01 12:00:21
(50 minutes ago)
35.220.163.178 - - [01/Sep/2026:14:00:20 +0200] "GET /. HTTP/1.1" 301 169 "-" "crusader-worker/1.0"
Web App Attack
🇹🇼
kk_it_man
2026-09-01 11:13:01
(1 hour ago)
ET INFO Request to Hidden Environment File - Inbound
ET WEB_SERVER Tilde in URI - potential .php~ ...
show more
ET INFO Request to Hidden Environment File - Inbound
ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability
show less
Port Scan
🇸🇪
vaia.cloud
2026-09-01 10:10:03
(2 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
2026-09-01 09:26:21
(3 hours ago)
35.220.163.178 cloud.patrz.eu - [01/Sep/2026:11:26:19 +0200] "GET /actuator/env HTTP/1.1" 404 5359 " ...
show more
35.220.163.178 cloud.patrz.eu - [01/Sep/2026:11:26:19 +0200] "GET /actuator/env HTTP/1.1" 404 5359 "-" "crusader-worker/1.0"
...
show less
Hacking
Web App Attack
🇮🇪
AutosOnShow
2026-09-01 09:01:03
(3 hours ago)
blocked for webapp attack | path requested: /.env | seen at 2026-09-01 09:00:44.933 |
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:56:43
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:56:36.231531 2026] [security2:error] [pid 32379:tid 32379] [client 35.220.163.178:38618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "saladmaster.starrmail.net"] [uri "/.env.example"] [unique_id "apaTROoyGl5ZKV-jFsQTFQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-01 08:51:16
(3 hours ago)
csagent: score 20.5: secrets grab x2, 404 noise floor x2; 1 domain(s) in 0s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:16:31
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:16:25.856224 2026] [security2:error] [pid 14280:tid 14280] [client 35.220.163.178:42688] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arnoldwell.com"] [uri "/.env.prod"] [unique_id "apaJ2b4piWIDHspjZ5gDEwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-09-01 07:51:08
(4 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇧🇾
shopmax
2026-09-01 07:48:45
(5 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇬🇧
consul.to
2026-09-01 07:41:34
(5 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
Viveronese
2026-09-01 07:25:17
(5 hours ago)
Wordpress vulnerability scanning
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 07:11:47
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:11:39.420854 2026] [security2:error] [pid 24339:tid 24339] [client 35.220.163.178:43146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mx1.asiancommoditiescorporation.com"] [uri "/wp-config.php~"] [unique_id "apZ6qwBUw0XGHI13Jrg_zAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 06:06:40
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.220.163.178 (178.163.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:06:35.283677 2026] [security2:error] [pid 25244:tid 25244] [client 35.220.163.178:43560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.fatcavestudios.com"] [uri "/wp-config.php.swp"] [unique_id "apZra0SkcYN5kSMplil20QAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack