🇳🇱
middelkoopcc
2026-11-11 21:31:01
UTC ·
(16 hours ago)
2026-11-11 22:29:23 GET /7fa2ef40245967628ae4.env [301] && 2026-11-11 22:29:24 GET /25b243f0055f8db3eef1.env [301] && 2026-11-11 22:29:24 GET /.env [301] && 128 more within 20 minutes
Web App Attack
Anonymous
2026-11-10 17:38:04
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇬🇧
Apache
2026-11-10 12:17:48
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 104.243.47.246 (US/United States/-): 5 in the last 300 secs (CF_ENABLE)
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-10 11:58:05
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
MPL
2026-11-09 21:39:35
UTC ·
(2 days ago)
tcp ports: 80,443 (8 or more attempts)
Port Scan
🇻🇮
Axel
2026-11-09 07:39:18
UTC ·
(3 days ago)
WAF/ModSecurity blocked 49 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: .ENV Files x25; request_uri: read wordpress configuration file x11; request_uri: .PHP backup files x4; blocked sensitive path x3; Block *.env x3; request_ ...
show more
WAF/ModSecurity blocked 49 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: .ENV Files x25; request_uri: read wordpress configuration file x11; request_uri: .PHP backup files x4; blocked sensitive path x3; Block *.env x3; request_uri: read joomla configuration file x2; request_uri: .git config x1. Latest: 2026-11-09T07:39:18Z.
show less
Hacking
Web App Attack
🇮🇹
CoreTech srl
2026-11-09 00:09:00
UTC ·
(3 days ago)
cloudlinux2 fail2ban: 2026-11-09 01:04:55,018 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 188.163.114.206 - 2026-11-09 01:04:54cloudlinux2 fail2ban: 2026-11-09 01:06:03,458 fail2ban.filter [1672]: INFO [plesk-modsecurit ...
show more
cloudlinux2 fail2ban: 2026-11-09 01:04:55,018 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 188.163.114.206 - 2026-11-09 01:04:54cloudlinux2 fail2ban: 2026-11-09 01:06:03,458 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 213.174.185.73 - 2026-11-09 01:06:03cloudlinux2 fail2ban: 2026-11-09 01:07:45,078 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 90.165.208.5 - 2026-11-09 01:07:44cloudlinux2 fail2ban: 2026-11-09 01:08:00,780 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 187.189.242.255 - 2026-11-09 01:07:59cloudlinux2 fail2ban: 2026-11-09 01:08:15,775 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 115.133.77.20 - 2026-11-09 01:08:15cloudlinux2 fail2ban: 2026-11-09 01:08:38,183 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 104.243.47.246 - 2026-11-09 01:08:38cloudlinux2 fail2ban: 2026-11-09 01:08:37,885 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 104.243.47.246 - 2026-11-09 01:
show less
Web App Attack
🇵🇱
Woytass
2026-11-08 23:49:14
UTC ·
(3 days ago)
CSF permanent block; ports=*; (mod_security) mod_security (id:210492) triggered by 104.243.47.246 (US/United States/-): 5 in the last 3600 secs
Web App Attack
🇺🇸
EmilGH
2026-11-08 23:37:54
UTC ·
(3 days ago)
104.243.47.246 - - [08/Nov/2026:23:37:52 +0000] "GET /b62a70a37e6db9f168e6.env HTTP/1.1" 404 105193 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.243.47.246 - - [08/Nov/2026: ...
show more
104.243.47.246 - - [08/Nov/2026:23:37:52 +0000] "GET /b62a70a37e6db9f168e6.env HTTP/1.1" 404 105193 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.243.47.246 - - [08/Nov/2026:23:37:53 +0000] "GET /f7ea1355f34b202a0bad.env HTTP/1.1" 404 101244 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.243.47.246 - - [08/Nov/2026:23:37:53 +0000] "GET /.env HTTP/1.1" 403 551 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.243.47.246 - - [08/Nov/2026:23:37:54 +0000] "GET /.env.development HTTP/1.1" 403 551 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.243.47.246 - - [08/Nov/2026:23:37:54 +0000] "GET /.env.dev HTTP/1.1" 403 4498 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G
...
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-08 22:59:18
UTC ·
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-07.
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-11-08 20:05:13
UTC ·
(3 days ago)
Scanning/Probing (15)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-08 12:32:09
UTC ·
(4 days ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.243.47.246 - - [08/Nov/2026:13:31:59 +0100] "GET /.env HTTP/1.1" 301 588 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605 ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.243.47.246 - - [08/Nov/2026:13:31:59 +0100] "GET /.env HTTP/1.1" 301 588 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
COMAITE
2026-11-08 11:36:40
UTC ·
(4 days ago)
Suspicious URL access.
Web App Attack
🇫🇮
wpwoodo
2026-11-08 08:14:31
UTC ·
(4 days ago)
Webpage crawler
Bad Web Bot
🇫🇷
masterguru
2026-11-08 02:00:04
UTC ·
(4 days ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack