🇳🇱
homeshowdomain.nl
2026-10-28 22:59:02
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-27.
Web App Attack
SSH
Hacking
🇬🇧
consul.to
2026-10-27 18:23:06
UTC ·
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
solantex
2026-10-27 17:48:40
UTC ·
(1 week ago)
Unauthorized automated scanning and reconnaissance against Solantex resources. No crawl, scan or test permission has been granted to this source.
Web App Attack
🇬🇧
KTSTechnology
2026-10-27 17:43:36
UTC ·
(1 week ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 08:37:32
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 04:37:28.783546 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 04:37:28.783546 2026] [security2:error] [pid 8936:tid 8936] [client 159.198.47.117:60708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mondosouk.com"] [uri "/api/.env"] [unique_id "auBiyGpPlmb2zx1XI41IgAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Jurilia
2026-10-27 08:27:30
UTC ·
(1 week ago)
Probing for secret/configuration files (.env, .git, credentials) that do not exist. 1 request. Paths probed: /core/.env. First seen 2026-10-27T08:27:30Z, last seen 2026-10-27T08:27:30Z (UTC). Blocked automatically.
Web App Attack
🇧🇷
fabiovb
2026-10-27 06:37:42
UTC ·
(1 week ago)
Blocked by CrowdSec: http-sensitive-files (5 events)
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-27 06:14:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 02:14:18.546172 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 02:14:18.546172 2026] [security2:error] [pid 3205:tid 3205] [client 159.198.47.117:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "spotlightjeanie.com"] [uri "/.env"] [unique_id "auBBOvJTtvlPv_DdWH1PXQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dharmachef
2026-10-27 05:19:31
UTC ·
(1 week ago)
2026-10-27T05:19:25+00:00: HTTP vulnerability scan rejected. Recognized signature: Secrets or source-control file probe. Source IP: 159.198.47.117.
Port Scan
🇹🇷
Jova
2026-10-27 05:18:17
UTC ·
(1 week ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
2026-10-27 05:17:36
UTC ·
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-27 03:53:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 23:53:53.909623 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 23:53:53.909623 2026] [security2:error] [pid 27675:tid 27675] [client 159.198.47.117:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nursingentranceprep.com"] [uri "/backend/.env"] [unique_id "auAgUYoazJCW3MWZhvwdWwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-27 03:05:22
UTC ·
(1 week ago)
Scanning/Probing (12)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 02:46:59
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 22:46:51.677845 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 22:46:51.677845 2026] [security2:error] [pid 21173:tid 21173] [client 159.198.47.117:46578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iuriscorpabc.com"] [uri "/app/.env"] [unique_id "auAQm95NBCfC0H3G9AscuQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 01:35:27
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:35:20.480741 2026] [security2:error] [pid ...
show more
(mod_security) mod_security (id:210492) triggered by 159.198.47.117 (baalitical-programmable.vpsrdns.web-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:35:20.480741 2026] [security2:error] [pid 32124:tid 32124] [client 159.198.47.117:51214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barsoom.app"] [uri "/.env"] [unique_id "at__2OwgbbJGJHiHQIw67QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
