🇳🇱
Alt255
2026-09-30 22:57:00
UTC ·
(1 month ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [01/Oct/2026:00:56:47 +0200] "GET /.env.bak HTTP/1.1" 301 578 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [01/Oct/2026:00:56:47 +0200] "GET /.env.bak HTTP/1.1" 301 578 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-29 20:59:28
UTC ·
(1 month ago)
Secret file probe | method: GET | path: /.aws/credentials, /.env | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15, Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KH ...
show more
Secret file probe | method: GET | path: /.aws/credentials, /.env | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15, Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-28 11:40:17
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 167.99.72.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 07:40:04.045407 2026] [security2:error] [pid 5342:tid 5342] [client 167.99.72.176:0] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 167.99.72.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 07:40:04.045407 2026] [security2:error] [pid 5342:tid 5342] [client 167.99.72.176:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "craftammie.com"] [uri "/.env"] [unique_id "arpSFFcB3l9w6pJTCUSM6AAAADg"], referer: https://www.google.com/search?q=craftammie.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-27 05:10:40
UTC ·
(1 month ago)
Try to access /.env.backup
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-26 22:01:28
UTC ·
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-25.
Web App Attack
SSH
Hacking
🇩🇪
Grossmann-Gruppe
2026-09-26 21:35:05
UTC ·
(1 month ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇺🇸
Lee Daniel
2026-09-26 05:27:50
UTC ·
(1 month ago)
167.99.72.176 - - [26/Sep/2026:01:27:50 -0400] "GET /.aws/credentials HTTP/1.1" 403 377 "https://charl-otte9753star.cbrazee4.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fwww.palmbeach.bb%2F.aws%2Fcredentials" "Mozilla/5.0 (compatible; Googlebot/2.1 ...
show more
167.99.72.176 - - [26/Sep/2026:01:27:50 -0400] "GET /.aws/credentials HTTP/1.1" 403 377 "https://charl-otte9753star.cbrazee4.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fwww.palmbeach.bb%2F.aws%2Fcredentials" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-26 03:05:03
UTC ·
(1 month ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [26/Sep/2026:05:04:45 +0200] "GET /.env.dist HTTP/1.1" 301 511 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google. ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [26/Sep/2026:05:04:45 +0200] "GET /.env.dist HTTP/1.1" 301 511 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Bad Web Bot
Web App Attack
2026-09-22 16:35:23
UTC ·
(1 month ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇳🇱
e.fierstra
2026-09-17 12:03:14
UTC ·
(1 month ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
COMAITE
2026-09-17 09:35:04
UTC ·
(1 month ago)
Suspicious URL access.
Web App Attack
🇨🇭
backslash
2026-09-17 09:06:01
UTC ·
(1 month ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
🇩🇪
Blexyel
2026-09-17 06:08:12
UTC ·
(1 month ago)
167.99.72.176 - - [17/Sep/2026:08:08:11 +0200] "GET /.git/config HTTP/1.1" 401 581 "https://billowing-sky-818d.qleasawq.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fdisk-monitoring.pingusmc.org%2F.git%2Fconfig" "Mozilla/5.0 (Windows NT 10.0; Win64; ...
show more
167.99.72.176 - - [17/Sep/2026:08:08:11 +0200] "GET /.git/config HTTP/1.1" 401 581 "https://billowing-sky-818d.qleasawq.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fdisk-monitoring.pingusmc.org%2F.git%2Fconfig" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "disk-monitoring.pingusmc.org"
...
show less
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-09-15 22:45:14
UTC ·
(1 month ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [16/Sep/2026:00:45:14 +0200] "GET /.env.dist HTTP/2.0" 301 357 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatib ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.99.72.176 - - [16/Sep/2026:00:45:14 +0200] "GET /.env.dist HTTP/2.0" 301 357 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-09-15 16:43:27
UTC ·
(1 month ago)
High-confidence malicious configuration/VCS probe
Web App Attack
