2026-10-13 13:45:11
(13 hours ago)
Observed scanned 2 known-sensitive endpoint(s), e.g.: /.env, /.git/config
Bad Web Bot
Web App Attack
🇩🇪
jasperedv.de
2026-10-13 12:24:26
(15 hours ago)
Apache Login - Brutforcing
Web App Attack
Brute-Force
🇫🇷
Lunix
2026-10-13 12:20:11
(15 hours ago)
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-10-13 12:14:18
(15 hours ago)
csagent: score 22.2: 404 noise floor x3, secrets grab x1, phpunit eval-stdin RCE x1; 1 domain(s) in ...
show more
csagent: score 22.2: 404 noise floor x3, secrets grab x1, phpunit eval-stdin RCE x1; 1 domain(s) in 1s
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 12:04:18
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 08:04:11.143885 2026] [security2:error] [pid 28353:tid 28353] [client 152.42.129.151:33764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lmga.net"] [uri "/.env"] [unique_id "as4eO9P2A4BIfPXdKgpk0wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-10-13 12:02:42
(15 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇫🇷
arsonist
2026-10-13 11:57:34
(15 hours ago)
[fail2ban]
2026-10-13T11:57:33.846756+00:00 arson caddy[1697]: {"level":"info","ts":1791892653.84672 ...
show more
[fail2ban]
2026-10-13T11:57:33.846756+00:00 arson caddy[1697]: {"level":"info","ts":1791892653.846727,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"152.42.129.151","remote_port":"6318","client_ip":"152.42.129.151","proto":"HTTP/2.0","method":"GET","host":"lm.arson.gg","uri":"/.env","headers":{"Accept-Encoding":["gzip, br, deflate"],"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"lm.arson.gg","ech":false}},"bytes_read":0,"user_id":"","duration":0.000092765,"size":7,"status":467,"resp_headers":{"Content-Type":["text/plain; charset=utf-8"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
...
show less
Bad Web Bot
🇫🇷
HerrWolf
2026-10-13 11:45:03
(15 hours ago)
CrowdSec Detection: crowdsecurity/CVE-2017-9841
Web App Attack
🇪🇸
Francisco Vallejo
2026-10-13 11:28:52
(16 hours ago)
[Tue Oct 13 13:28:51.976426 2026] [authz_core:error] [pid 423287:tid 423314] [client 152.42.129.151: ...
show more
[Tue Oct 13 13:28:51.976426 2026] [authz_core:error] [pid 423287:tid 423314] [client 152.42.129.151:59888] AH01630: client denied by server configuration: proxy:http://localhost:3001/
[Tue Oct 13 13:28:52.025681 2026] [authz_core:error] [pid 423287:tid 423325] [client 152.42.129.151:59888] AH01630: client denied by server configuration: proxy:http://localhost:3001/.env
[Tue Oct 13 13:28:52.077609 2026] [authz_core:error] [pid 423287:tid 423346] [client 152.42.129.151:59888] AH01630: client denied by server configuration: proxy:http://localhost:3001/wp
[Tue Oct 13 13:28:52.122139 2026] [authz_core:error] [pid 423287:tid 423335] [client 152.42.129.151:59942] AH01630: client denied by server configuration: proxy:http://localhost:3001/wordpress
[Tue Oct 13 13:28:52.123316 2026] [authz_core:error] [pid 423286:tid 423292] [client 152.42.129.151:59916] AH01630: client denied by server configuration: proxy:http://localhost:3001/
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-13 11:19:49
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:19:43.834708 2026] [security2:error] [pid 13332:tid 13332] [client 152.42.129.151:29500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "llew.life"] [uri "/.env"] [unique_id "as4Tz6Z31BvXhbRKlKlb_QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
itxworks.com
2026-10-13 11:16:47
(16 hours ago)
Honeypot hit: web probing / scanner. Auto-reported by CrowdSec.
Web App Attack
Bad Web Bot
🇩🇪
enjoyably
2026-10-13 11:16:46
(16 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/CVE-2017-9841
Web App Attack
🇩🇪
Lennart Kramer
2026-10-13 10:00:52
(17 hours ago)
Restricted File Access Attempt | Matched phrase "*/debug/*" at /debug/default/index | Mozilla/5.0 (W ...
show more
Restricted File Access Attempt | Matched phrase "*/debug/*" at /debug/default/index | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
show less
Hacking
Web App Attack
🇫🇷
Cuteminded
2026-10-13 09:39:35
(18 hours ago)
URL Probing: wordpress
Web Spam
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-13 09:12:13
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.129.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:12:06.817983 2026] [security2:error] [pid 13175:tid 13175] [client 152.42.129.151:26118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "livingwaterresortandspa.com"] [uri "/.env"] [unique_id "as315j_6AtN-V-g40Gc7GAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
