🇺🇸
ipblock.com
2026-11-02 18:07:00
UTC ·
(1 week ago)
IPBlock protected site ID [3192-af][s=06].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-02 18:04:42
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
freehosts.eu
2026-11-02 17:59:44
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from HU.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 • Generated by: github ...
show more
Triggered Cloudflare WAF (firewallCustom) from HU.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
nfsec.pl
2026-11-02 17:56:59
UTC ·
(1 week ago)
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /wp-config.php HTTP/1.1" 403 8028 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] ...
show more
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /wp-config.php HTTP/1.1" 403 8028 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /.env.production HTTP/1.1" 403 8027 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /.env.local HTTP/1.1" 403 8028 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /.env.bak HTTP/1.1" 403 8029 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
109.61.25.231 - - [02/Nov/2026:17:56:58 +0000] "GET /.env.old HTTP/1.1" 403 8029 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari
...
show less
Web App Attack
Exploited Host
🇳🇱
Justin Case
2026-10-17 04:30:03
UTC ·
(3 weeks ago)
Automatically denied: 24 error log hits on carlostkd.ch
Fraud Orders
🇺🇸
ipblock.com
2026-10-16 18:30:00
UTC ·
(3 weeks ago)
IPBlock protected site ID [3192-af][s=06].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇮🇩
David Koswari
2026-10-16 05:12:00
UTC ·
(3 weeks ago)
REQ_BLOCKED_SECURITY
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇫🇷
SpaceHost-Server
2026-10-15 22:14:56
UTC ·
(3 weeks ago)
Brute-Force
Web App Attack
🇫🇷
RtheCompany.eu
2026-10-15 14:24:02
UTC ·
(3 weeks ago)
Malicious behaviour from this IP was confirmed from our own evidence, but the exact pattern is not covered by the quick reasons above. Automated probing for web application vulnerabilities was observed from this IP.
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-14 22:14:56
UTC ·
(3 weeks ago)
Brute-Force
Web App Attack
🇺🇸
EvilTurkey
2026-10-14 18:53:08
UTC ·
(3 weeks ago)
Web app attack against financial institution website.
Web App Attack
Hacking
🇧🇷
ICS Labs
2026-10-14 15:18:17
UTC ·
(3 weeks ago)
ICS Labs threat intelligence (ICS Feeds): Hacking, Brute-Force. Last observed 2026-10-14 UTC.
Hacking
Brute-Force
🇩🇪
macrob
2026-10-14 14:17:53
UTC ·
(3 weeks ago)
2026/10/14 14:17:51 [error] 3960607#3960607: *51571363 access forbidden by rule, client: 109.61.25.231, server: binixo.ph, request: "GET /config/.env HTTP/1.1", host: "binixo.ph"
2026/10/14 14:17:51 [error] 3960607#3960607: *51571364 access forbidden ...
show more
2026/10/14 14:17:51 [error] 3960607#3960607: *51571363 access forbidden by rule, client: 109.61.25.231, server: binixo.ph, request: "GET /config/.env HTTP/1.1", host: "binixo.ph"
2026/10/14 14:17:51 [error] 3960607#3960607: *51571364 access forbidden by rule, client: 109.61.25.231, server: binixo.ph, request: "GET /.env.backup HTTP/1.1", host: "binixo.ph"
2026/10/14 14:17:51 [error] 3960607#3960607: *51571365 access forbidden by rule, client: 109.61.25.231, server: binixo.ph, request: "GET /.env.bak HTTP/1.1", host: "binixo.ph"
...
show less
Web App Attack
🇮🇹
VHosting
2026-10-14 11:40:06
UTC ·
(3 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 11:26:14
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 109.61.25.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:26:06.605995 2026] [security2:error] [pid 12571:tid 12571] [client 109.61.25.231:58867] M ...
show more
(mod_security) mod_security (id:210492) triggered by 109.61.25.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:26:06.605995 2026] [security2:error] [pid 12571:tid 12571] [client 109.61.25.231:58867] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dmasoftlab.com"] [uri "/.env.bak"] [unique_id "as9mzqpkXYWqQjlOtZvVqAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
