🇺🇸
TPI-Abuse
2026-09-06 05:53:12
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 01:53:06.884600 2026] [security2:error] [pid 31621:tid 31621] [client 35.241.77.51:43926] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||handshake.tv|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "handshake.tv"] [uri "/database.sql"] [unique_id "apz_wtgqf1-gAzlyxrVCMAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-09-06 05:13:19
(2 hours ago)
14 attacks on env grabbing URLs, too many concurrent requests, PHP URLs:
GET /.env.production HTTP/1 ...
show more
14 attacks on env grabbing URLs, too many concurrent requests, PHP URLs:
GET /.env.production HTTP/1.1
GET /_ignition/health-check HTTP/1.1
GET /wp-config.php.swp HTTP/1.1
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 03:02:05
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 23:02:00.511094 2026] [security2:error] [pid 9079:tid 9079] [client 35.241.77.51:48976] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.cookerwars.com"] [uri "/.env"] [unique_id "apzXqP9ZYIpWkAa73d55mAAAAIA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-06 02:24:18
(5 hours ago)
Web scanner: GET /.env.example
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-06 01:58:32
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 21:58:26.938242 2026] [security2:error] [pid 17123:tid 17123] [client 35.241.77.51:55500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelholdawayvideos.info"] [uri "/wp-config.php~"] [unique_id "apzIwsPZTtiUqqjJ0nIr4QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-06 01:51:45
(5 hours ago)
[Wordpress] crawler /wp-admin/*, /wp-content/*, etc.
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-09-06 01:00:11
(6 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 00:29:49
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 20:29:41.920098 2026] [security2:error] [pid 5805:tid 5805] [client 35.241.77.51:56670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mx20.itimetable21.com"] [uri "/wp-config.php~"] [unique_id "apyz9cnXH_adWoCe3bV4uAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Séfora Srl
2026-09-06 00:16:55
(7 hours ago)
crowdsecurity/http-probing detected by CrowdSec
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:54:24
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:54:17.968706 2026] [security2:error] [pid 11236:tid 11236] [client 35.241.77.51:39124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.blisseventboutique.com"] [uri "/.env.prod"] [unique_id "apyrqaP_UHESmPBjapAA3gAAAHk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 23:14:24
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 19:14:19.430324 2026] [security2:error] [pid 10312:tid 10312] [client 35.241.77.51:50964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test0304.jmnr.net"] [uri "/wp-config.php~"] [unique_id "apyiS1xL8n1TmXQdPsRPZgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-05 21:40:23
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.241.77.51 (51.77.241.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:40:18.531983 2026] [security2:error] [pid 31344:tid 31344] [client 35.241.77.51:50760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.elgatocapa.com"] [uri "/.env.production"] [unique_id "apyMQqfmInD2HcmIXEdv1QAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
penjaga BRIN
2026-09-05 21:02:53
(10 hours ago)
Suspicious malicious activity
Hacking
🇫🇷
pm33
2026-09-05 20:49:04
(10 hours ago)
Wordpress login attempts
Brute-Force
Anonymous
2026-09-05 20:41:24
(11 hours ago)
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "crusader- ...
show more
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.example HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.old HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.dev HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.bak HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 35.241.77.51
35.241.77.51 - - [05/Sep/2026:15:40:29 -0500]
...
show less
Brute-Force
Bad Web Bot
Web App Attack