🇩🇪
NxtGenIT
2026-07-21 11:54:03
(5 hours ago)
Tanner Honeypot hit, Event Type: , HTTP Method: POST, User Agent: , URI: /
SSH
🇨🇿
rawnullbyte
2026-07-21 11:42:48
(5 hours ago)
🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /ftp-config.json 👤 Attacker IP: 167 ...
show more
🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /ftp-config.json 👤 Attacker IP: 167.99.70.147 ⏰ Time: 2026-07-21 11:42:48 📡 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-21 10:49:09
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 167.99.70.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 167.99.70.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 06:49:03.262158 2026] [security2:error] [pid 32612:tid 32612] [client 167.99.70.147:32950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web4.dnchosting.com"] [uri "/.env.development"] [unique_id "al9On_vN_awTQXhh-tK0igAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
HamSammich
2026-07-21 10:18:42
(6 hours ago)
Automated sensor: 31 HTTP connection/probe attempts over the last 24h (latest 2026-07-21T10:18Z).
Brute-Force
Web App Attack
🇨🇭
4server
2026-07-21 09:38:23
(7 hours ago)
[TueJul2111:38:20.0629152026][security2:error][pid1437925:tid1438184][client167.99.70.147:0]ModSecur ...
show more
[TueJul2111:38:20.0629152026][security2:error][pid1437925:tid1438184][client167.99.70.147:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"hostingedominio.ch\"][uri\"/.env\"][unique_id\"al8-DNcQg4bhcQYhyBsR_QAAAAo\"]
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-07-21 05:00:08
(12 hours ago)
CrowdSec: crowdsecurity/http-sensitive-files | req: /.env.aws | 5 distinct paths | UA: Mozilla/5.0 ( ...
show more
CrowdSec: crowdsecurity/http-sensitive-files | req: /.env.aws | 5 distinct paths | UA: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
show less
Hacking
🇫🇮
as211431.net
2026-07-21 04:40:05
(12 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.github/workflows/build.yml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇰
SaltySoftworks
2026-07-21 04:34:24
(12 hours ago)
Connecting to IP instead of domain name
Hacking
Web App Attack
🇬🇧
Blake
2026-07-21 02:37:03
(14 hours ago)
167.99.70.147 "-" "-" - [21/Jul/2026:02:37:02 +0000] "GET /.env.0 HTTP/1.1" 404 "Mozilla/5.0 (Window ...
show more
167.99.70.147 "-" "-" - [21/Jul/2026:02:37:02 +0000] "GET /.env.0 HTTP/1.1" 404 "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" ATTACK
...
show less
Web App Attack
🇦🇺
2000cn.com.au
2026-07-21 00:49:19
(16 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇹🇭
MWA SOC
2026-07-21 00:48:58
(16 hours ago)
Hacking
2026-07-21 00:28:11
(16 hours ago)
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env.0 HTTP/1.1" 403 543 "-" "Mozilla/5.0 (iPho ...
show more
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env.0 HTTP/1.1" 403 543 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15"
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env.build HTTP/1.1" 403 543 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env.2 HTTP/1.1" 403 543 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36"
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env.ci HTTP/1.1" 403 543 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15"
167.99.70.147 - - [21/Jul/2026:02:28:03 +0200] "GET /.env HTTP/1.1" 403 543 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537
...
show less
DDoS Attack
🇩🇪
EnthecSolutions
2026-07-20 22:01:59
(19 hours ago)
Detected by Enthec Solutions. | Attempts: 186 in 24h | Target port: 25
Email Spam
Brute-Force
🇫🇮
inlink.ltd
2026-07-20 21:23:53
(19 hours ago)
dot file probe
Web App Attack
2026-07-20 21:12:06
(19 hours ago)
Bot / scanning and/or hacking attempts: POST / HTTP/1.1, GET /.env HTTP/1.1
Hacking
Web App Attack