2026-06-07 07:34:36
(1 week ago)
Aggressive web scan
Web App Attack
🇮🇩
securejdprop
2026-06-06 00:14:11
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO User-Agent ...
show more
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO User-Agent (python-requests) Inbound to Webserver). Ip 109.61.86.194 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-06 00:14:09.763094723 +0000 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-30 05:36:17
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 01:36:11.011594 2026] [security2:error] [pid 26662:tid 26662] [client 109.61.86.194:23876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web71.dnchosting.com"] [uri "/.env.bak1"] [unique_id "ahp3SzpYvya3a6Y7sWCFrQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-05-30 05:34:14
(2 weeks ago)
529 requests with url.path *.env
Brute-Force
Bad Web Bot
🇨🇦
SSH-Admin
2026-05-29 04:00:05
(3 weeks ago)
Probing for Exploits on ns200
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 00:56:17
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 20:56:13.749537 2026] [security2:error] [pid 9744:tid 9744] [client 109.61.86.194:28496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bitcoinsquaretrade.com"] [uri "/.env.previous"] [unique_id "ahjkLXVi53WiLaXUR0tS_wAAAH8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SSH-Admin
2026-05-29 00:41:02
(3 weeks ago)
Probing for Exploits on ns007
Exploited Host
Web App Attack
🇳🇿
Antinson
2026-05-29 00:30:17
(3 weeks ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇳🇱
grinthorstnl
2026-05-28 21:59:02
(3 weeks ago)
Auto-ban: >500 bad req(40x/50x)/5min on 2026-05-27
Web App Attack
SSH
Hacking
🇩🇪
jasperedv.de
2026-05-28 06:01:13
(3 weeks ago)
Apache Login - Brutforcing
Web App Attack
Brute-Force
🇬🇧
prime_fusion_ld
2026-05-27 03:14:11
(3 weeks ago)
Blocked by CSF/LFD on vps.primefusion.co.uk. Trigger: 1 Ports: *
Port Scan
🇧🇷
dominioz
2026-05-27 03:08:38
(3 weeks ago)
2026-05-27 03:08:16 GET /.env.3 - - 109.61.86.194 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) ...
show more
2026-05-27 03:08:16 GET /.env.3 - - 109.61.86.194 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) - 404 1440
2026-05-27 03:08:16 GET /.env.bak - - 109.61.86.194 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) - 404 1440
2026-05-27 03:08:16 GET /.env.2 - - 109.61.86.194 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) - 404 1440
2026-05-27 03:08:16 GET /.env.swp - - 109.61.86.194 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) - 404 1440
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 03:01:02
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com ...
show more
(mod_security) mod_security (id:210492) triggered by 109.61.86.194 (unn-109-61-86-194.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 23:00:54.675100 2026] [security2:error] [pid 19003:tid 19003] [client 109.61.86.194:43048] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web15.dnchosting.com"] [uri "/.env.dev"] [unique_id "ahZeZnAJrUsB1irlhaFVMQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-05-25 06:22:15
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack