🇺🇸
WellSpring
2026-08-24 06:11:35
(1 week ago)
env leak on 309.today/public/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-22 22:01:13
(1 week ago)
Auto-ban: >3000 req/min op 2026-08-22
Web App Attack
SSH
Hacking
🇫🇷
Octopuce
2026-08-22 17:15:16
(1 week ago)
Aggressive web search of vulnerable pages: / /.env /.env.local /app/.env /apps/.env ...
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 15:18:51
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 15.222.34.156 (ec2-15-222-34-156.ca-central-1.c ...
show more
(mod_security) mod_security (id:210492) triggered by 15.222.34.156 (ec2-15-222-34-156.ca-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 11:18:43.388361 2026] [security2:error] [pid 11484:tid 11484] [client 15.222.34.156:47216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.montidaunitour.com.my-spec.com"] [uri "/.git/config"] [unique_id "aom901VsL78ncXEZZm1A_AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-08-22 13:48:01
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-08-22 13:46:56
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
mnsf
2026-08-22 13:05:03
(1 week ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇮🇹
mediarama.com
2026-08-22 12:41:50
(1 week ago)
Banned by Fail2Ban
Web App Attack
2026-08-22 10:09:40
(1 week ago)
(caddyscan) Scanner path probe from 15.222.34.156 (CA/Canada/ec2-15-222-34-156.ca-central-1.compute. ...
show more
(caddyscan) Scanner path probe from 15.222.34.156 (CA/Canada/ec2-15-222-34-156.ca-central-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 15.222.34.156 - - [22/Aug/2026:10:09:35 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 15.222.34.156 - - [22/Aug/2026:10:09:35 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 15.222.34.156 - - [22/Aug/2026:10:09:35 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 15.222.34.156 - - [22/Aug/2026:10:09:35 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 15.222.34.156 - - [22/Aug/2026:10:09:35 +0000] "GET /.env.staging HTTP/1.1"
show less
Port Scan
🇬🇧
openstrike.co.uk
2026-08-22 05:15:28
(1 week ago)
250 attacks on VC URLs, PHP URLs, env grabbing URLs:
GET /.git/config HTTP/1.1
GET /includes/phpinfo ...
show more
250 attacks on VC URLs, PHP URLs, env grabbing URLs:
GET /.git/config HTTP/1.1
GET /includes/phpinfo.php HTTP/1.1
GET /config/app/.env HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-21 23:57:14
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 15.222.34.156 (ec2-15-222-34-156.ca-central-1.c ...
show more
(mod_security) mod_security (id:210492) triggered by 15.222.34.156 (ec2-15-222-34-156.ca-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 19:57:06.201899 2026] [security2:error] [pid 12088:tid 12088] [client 15.222.34.156:45778] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.morleysales.oceansgift.com"] [uri "/.git/config"] [unique_id "aojl0g5qjpXNXJJPnwzGNAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-08-21 20:55:05
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-08-21 17:37:49
(1 week ago)
908 requests with url.path *.env
Brute-Force
Bad Web Bot
🇫🇷
dynamix
2026-08-21 14:24:07
(1 week ago)
Multiple WAF Violations
Web App Attack
🇩🇪
4server
2026-08-21 10:35:25
(1 week ago)
[FriAug2112:35:21.5405842026][security2:error][pid953755:tid953800][client15.222.34.156:0]ModSecurit ...
show more
[FriAug2112:35:21.5405842026][security2:error][pid953755:tid953800][client15.222.34.156:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.mood4apps.com.136-243-54-122.cpanel.site\"][uri\"/.env.bak\"][unique_id\"aogp6deUIQ_2qNdrq0TGNgAAAQU\"]
show less
Port Scan
Brute-Force
Web App Attack