🇳🇱
Site.eu
2026-10-27 02:52:01
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
lolyay
2026-10-26 22:10:41
(1 day ago)
136.70.212.175 - - [26/Oct/2026:22:10:40 +0000] "GET /.bashrc HTTP/1.1" 200 4 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
136.70.212.175 - - [26/Oct/2026:22:10:40 +0000] "GET /@fs/va ...
show more
136.70.212.175 - - [26/Oct/2026:22:10:40 +0000] "GET /.bashrc HTTP/1.1" 200 4 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
136.70.212.175 - - [26/Oct/2026:22:10:40 +0000] "GET /@fs/var/task/.env?raw?? HTTP/1.1" 200 4 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
...
show less
Web App Attack
Bad Web Bot
🇩🇪
updown.io
2026-10-26 14:22:22
(2 days ago)
{"level":"info","ts":1793024539.8688576,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.70.212.175","remote_port":"57584","client_ip":"136.70.212.175","proto":"HTTP/2.0","method":"GET","host":"status.archive.is","u ...
show more
{"level":"info","ts":1793024539.8688576,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.70.212.175","remote_port":"57584","client_ip":"136.70.212.175","proto":"HTTP/2.0","method":"GET","host":"status.archive.is","uri":"/.env.prod","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.archive.is","ech":false}},"bytes_read":0,"user_id":"","duration":0.000133706,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1793024539.870534,"logger":"http.log.access.log1","msg":"handl
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 14:09:21
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 10:09:16.799763 2026] [security2:error] [pid 3432:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 10:09:16.799763 2026] [security2:error] [pid 3432:tid 3432] [client 136.70.212.175:60954] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.thn.bz"] [uri "/.env.backup"] [unique_id "at9fDLW9xppktwdYnG99jgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
venus.launch.bz
2026-10-26 13:58:34
(2 days ago)
(mod_security) mod_security triggered on hostname [redacted] 136.70.212.175 (US/United States/175.212.70.136.bc.googleusercontent.com)
SQL Injection
🇺🇸
TPI-Abuse
2026-10-26 13:14:11
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:14:07.307970 2026] [security2:error] [pid 5390:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 09:14:07.307970 2026] [security2:error] [pid 5390:tid 5405] [client 136.70.212.175:45092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.executive.bz"] [uri "/media../.env"] [unique_id "at9SHwNjgpWd-00lHocBBwAAAQY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 12:53:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 08:53:51.308803 2026] [security2:error] [pid 31583:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.70.212.175 (175.212.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 08:53:51.308803 2026] [security2:error] [pid 31583:tid 31583] [client 136.70.212.175:56796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.daveewalker.bz"] [uri "/.env.testing"] [unique_id "at9NX-IEyOe6hB-RMLwJVgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
lns.bz
2026-10-26 12:52:33
(2 days ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇪🇸
masterguru
2026-10-26 06:09:03
(2 days ago)
Inbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110-122)
Hacking
🇳🇱
Savvii
2026-10-26 02:33:11
(2 days ago)
20 attempts against mh-misbehave-ban on onion
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-26 02:28:42
(2 days ago)
612 requests with url.path *.env
238 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
🇩🇪
bazter.pro
2026-10-25 23:51:31
(2 days ago)
Fail2Ban: plesk-bot-aggressive - 15 failures
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-10-25 22:31:27
(2 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-25T22:27:47.000Z.
Web App Attack
🇫🇷
Octopuce
2026-10-25 21:21:43
(2 days ago)
Aggressive web search of vulnerable pages: /wp-admin/.env /docker-compose.yml /.env /apps/.env /client/.env ...
Web App Attack
🇩🇪
raph
2026-10-25 20:05:52
(2 days ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
