🇩🇪
big-cloud.nl
2026-11-09 18:13:26
UTC ·
(13 hours ago)
Try to access /.git/config
Web App Attack
🇮🇱
spd.co.il
2026-11-08 20:01:43
UTC ·
(1 day ago)
Web application attack detected
Hacking
Web App Attack
🇳🇱
middelkoopcc
2026-11-08 00:56:01
UTC ·
(2 days ago)
2026-11-08 01:53:42 GET /.git/config [301] && 2026-11-08 01:53:43 GET /.git/config [404] && 2026-11-08 01:53:44 GET /.env [301] && 201 more within 20 minutes
Web App Attack
🇧🇪
cmbplf
2026-11-07 21:29:20
UTC ·
(2 days ago)
162 requests with url.path *.env
Brute-Force
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-11-06 23:02:01
UTC ·
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-05.
Web App Attack
SSH
Hacking
🇳🇱
Site.eu
2026-11-06 21:04:21
UTC ·
(3 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-11-06 20:54:28
UTC ·
(3 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-06 01:19:00
UTC ·
(4 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: dev.dont-eat-the-pudding.online | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: dev.dont-eat-the-pudding.online | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 00:22:04
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:21:59.845973 2026] [security2:error] [pid 3930356:tid 3930380] [client 150.109.172.136: ...
show more
(mod_security) mod_security (id:210492) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:21:59.845973 2026] [security2:error] [pid 3930356:tid 3930380] [client 150.109.172.136:36564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "giogalati.com"] [uri "/.git/config"] [unique_id "au0dpyX4sgzUOHhHHvDSEQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-05 23:00:29
UTC ·
(4 days ago)
Auto-ban: >3000 req/min op 2026-11-05
Web App Attack
SSH
Hacking
🇩🇪
Mr-Money
2026-11-05 20:15:39
UTC ·
(4 days ago)
scenario: crowdsecurity/modsecurity - events: 1 - Matched Data: $((41*271) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).exe ...
show more
scenario: crowdsecurity/modsecurity - events: 1 - Matched Data: $((41*271) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}
show less
Web App Attack
🇮🇱
spd.co.il
2026-11-05 20:01:41
UTC ·
(4 days ago)
Web application attack detected
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 19:07:39
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:07:31.788368 2026] [security2:error] [pid 29948:tid 29948] [client 150.109.172.136:4385 ...
show more
(mod_security) mod_security (id:210492) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:07:31.788368 2026] [security2:error] [pid 29948:tid 29948] [client 150.109.172.136:43856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.willowstick-carbon.com"] [uri "/.git/config"] [unique_id "auzT80fiP0IhGt-MFr9dHgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-05 18:05:04
UTC ·
(4 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 14:23:14
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 09:23:10.496030 2026] [security2:error] [pid 23191:tid 23191] [client 150.109.172.136:5049 ...
show more
(mod_security) mod_security (id:210730) triggered by 150.109.172.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 09:23:10.496030 2026] [security2:error] [pid 23191:tid 23191] [client 150.109.172.136:50496] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||g-h2o.com|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "g-h2o.com"] [uri "/.env.bak"] [unique_id "auyRTi4OV7Vc7OSQjbCZ1QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
