2025-04-20 11:42:53
(1 year ago)
Aggressive web scan
Web App Attack
🇨🇭
Peter-Johann Sarbach
2025-02-22 10:30:27
(1 year ago)
hacking
Hacking
2025-02-21 23:54:18
(1 year ago)
Reported from Nginx log analysis 19. Log: 152.42.176.88 - - [21/Feb/2025:xx:xx:xx 0000] "GET /.env ...
show more
Reported from Nginx log analysis 19. Log: 152.42.176.88 - - [21/Feb/2025:xx:xx:xx 0000] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 Keydrop" "-" "SG Singapore Singapore" "AS14061" "DIGITALOCEAN-ASN" | 152.42.176.88 - - [21/Feb/2025:xx:xx:xx 0000] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 Keydrop" "-" "SG Singapore Singapore" "AS14061" "DIGITALOCEAN-ASN"
show less
Port Scan
Brute-Force
SSH
🇪🇸
Gem
2025-02-21 23:22:56
(1 year ago)
Unauthorized web scan.
Web App Attack
🇺🇸
WebRanger
2025-02-21 20:34:37
(1 year ago)
GET /.env HTTP/1.1 403 497 "- GET /.env HTTP/1.1" 403 497 "-" "Mozilla/5.0 Keydrop" "-
Web App Attack
🇺🇸
chronos
2025-02-21 20:33:04
(1 year ago)
[AUTORAVALT][[21/02/2025 - 17:33:03 -03:00 UTC]
Attack from [DigitalOcean, LLC]
[152.42.176.88] Acti ...
show more
[AUTORAVALT][[21/02/2025 - 17:33:03 -03:00 UTC]
Attack from [DigitalOcean, LLC]
[152.42.176.88] Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software plug]
...
show less
Hacking
Web App Attack
2025-02-21 20:30:02
(1 year ago)
Configuration snooping (/.env), accessed by IP not domain:
152.42.176.88 - - [21/Feb/2025:20:29:55 ...
show more
Configuration snooping (/.env), accessed by IP not domain:
152.42.176.88 - - [21/Feb/2025:20:29:55 +0000] "GET /.env HTTP/1.1" 404 321 "-" "Mozilla/5.0 Keydrop"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-02-21 20:29:12
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 21 15:29:07.159222 2025] [security2:error] [pid 8209:tid 8209] [client 152.42.176.88:46352] [client 152.42.176.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.39"] [uri "/.env"] [unique_id "Z7jiE1srdDMmsfp4noslQQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-02-21 20:10:03
(1 year ago)
Hacking
🇫🇷
LRNP
2025-02-21 19:59:23
(1 year ago)
_:443 152.42.176.88 - - [21/Feb/2025:19:59:18 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 K ...
show more
_:443 152.42.176.88 - - [21/Feb/2025:19:59:18 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 Keydrop"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-21 19:58:11
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 21 14:58:07.751116 2025] [security2:error] [pid 6772:tid 6772] [client 152.42.176.88:39692] [client 152.42.176.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.110"] [uri "/.env"] [unique_id "Z7jaz7n83VuV1h4Ow7nQvwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
lumbermatt_de
2025-02-21 19:51:23
(1 year ago)
Vulnerability exploit attack detected
Web App Attack
🇺🇸
TPI-Abuse
2025-02-21 19:35:46
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 21 14:35:43.357726 2025] [security2:error] [pid 17771:tid 17771] [client 152.42.176.88:40448] [client 152.42.176.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.74"] [uri "/.env"] [unique_id "Z7jVjxlYY1OeTfwNLz8u5gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇬
pa4080
2025-02-21 19:28:05
(1 year ago)
Detected by ModSecurity. Request URI: /.env
Web App Attack
🇺🇸
TPI-Abuse
2025-02-21 19:11:20
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 152.42.176.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 21 14:11:14.163373 2025] [security2:error] [pid 30257:tid 30257] [client 152.42.176.88:40180] [client 152.42.176.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.37"] [uri "/.env"] [unique_id "Z7jP0qhamshiRwb3GPgokAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack