🇨🇭
copestack
2026-10-16 01:30:10
(1 day ago)
Honeypot hit on ov-4e5936 (fail2ban jail: roridula-feed)
Port Scan
🇳🇱
homeshowdomain.nl
2026-10-15 22:01:02
(1 day ago)
Auto-ban: >3000 req/min op 2026-10-15
Web App Attack
SSH
Hacking
🇧🇷
ICS Labs
2026-10-15 13:43:50
(1 day ago)
ICS Labs threat intelligence (ICS Feeds): Hacking. Last observed 2026-10-15 UTC.
Hacking
🇳🇱
Site.eu
2026-10-15 11:14:33
(1 day ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-15 06:49:41
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:49:37.093385 2026] [security2:error] [pid 23047:tid 23047] [client 170.64.146.129:20308] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arogun.org"] [uri "/.env"] [unique_id "atB3gRKDBZ5DvLqquG1siwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-15 06:45:21
(2 days ago)
Try to access /.env
Web App Attack
🇩🇪
arnisolutions
2026-10-15 06:42:40
(2 days ago)
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production s ...
show more
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 1 day(s) between 2026-10-15 and 2026-10-15 (UTC). Sample request: GET /vendor/laravel-filemanager/js/script.js HTTP/2.0
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-15 06:27:52
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:27:44.945898 2026] [security2:error] [pid 30590:tid 30590] [client 170.64.146.129:48900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armorcorp.gulftelecom.com"] [uri "/.env"] [unique_id "atByYAkqLov3anumd9F_MgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
/dev/null
2026-10-15 06:12:53
(2 days ago)
Web attack | malicious scanning detected.
Hacking
Web App Attack
🇫🇷
Jimbo67
2026-10-15 06:03:48
(2 days ago)
Cloudflare WAF: 3 hits in 30s | action=block | abuse=suspicious_probe | categories=19,21 | rule_id=0 ...
show more
Cloudflare WAF: 3 hits in 30s | action=block | abuse=suspicious_probe | categories=19,21 | rule_id=0189a8c2c2ab4a60bc709bad14577d18 | URIs=/.env,/.git/config,/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | confidence=0.86
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 05:54:54
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:54:49.398862 2026] [security2:error] [pid 14194:tid 14194] [client 170.64.146.129:61116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkqp.kreweofhyatt.com"] [uri "/.env"] [unique_id "atBqqSoebSojdOEy-dzIIgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wordpresshosting.solutions
2026-10-15 05:45:19
(2 days ago)
Web brute-force / failed auth detected. Evidence: [Thu Oct 15 05:45:17.953690 2026] [authz_core:erro ...
show more
Web brute-force / failed auth detected. Evidence: [Thu Oct 15 05:45:17.953690 2026] [authz_core:error] [pid 2870842] [client [IP]:0] AH01630: client [IP]nied by server configuration: [WEB_ROOT]/.env
[Thu Oct 15 05:45:18.389108 2026] [authz_core:error] [pid 2871898] [client [IP]:0] AH01630: client [IP]nied by server configuration: [WEB_ROOT]/.git
show less
Brute-Force
Web App Attack
🇫🇷
UnixPrime
2026-10-15 05:42:55
(2 days ago)
170.64.146.129 - - [15/Oct/2026:07:42:54 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdi ...
show more
170.64.146.129 - - [15/Oct/2026:07:42:54 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
170.64.146.129 - - [15/Oct/2026:07:42:55 +0200] "GET /.env HTTP/1.1" 404 4114 "https://arkaniaz.fr/.env" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇲🇽
mcabanas
2026-10-15 05:42:43
(2 days ago)
[ARKAND Sentinel Security Engine] Hostile activity detected & blocked at Linux kernel (iptables). Ta ...
show more
[ARKAND Sentinel Security Engine] Hostile activity detected & blocked at Linux kernel (iptables). Target: arkand.mx. Reason: Nginx Shield Trap (HTTP 418): intento de acceso a ruta protegida '/.env' [RBL: Spamhaus ZEN]. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36. Path: GET /.env HTTP/2.0.
show less
Port Scan
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 05:30:17
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.146.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:30:11.160933 2026] [security2:error] [pid 1172:tid 1172] [client 170.64.146.129:1738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arizonachristmascards.com"] [uri "/.env"] [unique_id "atBk4xqpiIm9aIM1z_EcGQAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack