🇳🇱
Site.eu
2026-10-23 05:37:38
(3 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
ger-stg-sifi1
2026-10-23 04:56:03
(3 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 04:27:28
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:27:24.156261 2026] [security2:error] [pid 395:tid 395] [client 124.223.201.42:44522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.uheep2.spaceritual.net"] [uri "/.env.local"] [unique_id "atriLOqNj1Qm7bgPF9LDFwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-23 04:24:33
(4 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
masterguru
2026-10-23 02:08:43
(6 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-23 01:42:52
(6 hours ago)
(modsec_attack) srv103 ModSecurity attack 124.223.201.42 (CN/China/-): 3 in the last 3600 secs; Port ...
show more
(modsec_attack) srv103 ModSecurity attack 124.223.201.42 (CN/China/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 00:44:12
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 20:44:05.761459 2026] [security2:error] [pid 29733:tid 29733] [client 124.223.201.42:36372] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.prim.rustyog.net|F|2"] [data ".env.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.prim.rustyog.net"] [uri "/.env.backup"] [unique_id "atqt1QUkISwrbYOCGmxh8wAAAAQ"], referer: https://www.google.com/search?q=www.prim.rustyog.net
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-23 00:24:56
(8 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-10-23 00:14:21
(8 hours ago)
Scanning/Probing (16)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 23:09:25
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.223.201.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:09:17.801703 2026] [security2:error] [pid 12937:tid 12937] [client 124.223.201.42:58236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.myersbarnescpa.com"] [uri "/.git/HEAD"] [unique_id "atqXnQhFd-KULneYWVfZdQAAAB0"], referer: https://www.google.com/search?q=www.myersbarnescpa.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-22 22:54:13
(9 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
markawes
2026-10-22 22:25:26
(10 hours ago)
[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. ...
show more
[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. Evidence:
124.223.201.42 - - [22/Oct/2026:23:25:25 +0100] "GET /.git/HEAD HTTP/1.1" 301 539 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
124.223.201.42 - - [22/Oct/2026:23:25:25 +0100] "GET /.git/config HTTP/1.1" 301 543 "https://www.google.com/search?q=www.markis.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
124.223.201.42 - - [22/Oct/2026:23:25:25 +0100] "GET /.env HTTP/1.1" 301 529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
show less
Port Scan
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-22 22:00:17
(10 hours ago)
Auto-ban: >3000 req/min op 2026-10-22
Web App Attack
SSH
Hacking
2026-10-22 20:25:05
(12 hours ago)
Bot / scanning and/or hacking attempts: GET / HTTP/1.1, GET /.env.development.local HTTP/1.1, GET /a ...
show more
Bot / scanning and/or hacking attempts: GET / HTTP/1.1, GET /.env.development.local HTTP/1.1, GET /admin HTTP/1.1, GET /app HTTP/1.1, GET /api/config HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-22 20:22:29
(12 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking