2026-10-15 04:33:17
(2 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
Bedios GmbH
2026-10-13 13:48:04
(4 days ago)
Scanning for exposed credentials and private keys.
Hacking
🇺🇸
JGouin
2026-10-13 10:56:31
(4 days ago)
170.64.222.174 [13/Oct/2026:06:56:31 -0400] "GET /wordpress HTTP/2.0" 200 tarpit_triggered
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 10:29:49
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:29:45.635797 2026] [security2:error] [pid 5629:tid 5629] [client 170.64.222.174:43998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.app.megaandina.com"] [uri "/.env"] [unique_id "as4IGV1x-XSAz97nsk7MBgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 09:57:43
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:57:35.605435 2026] [security2:error] [pid 10677:tid 10677] [client 170.64.222.174:9180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.applemaccomputerconsulting.com"] [uri "/.env"] [unique_id "as4Aj7uO_Qu-fsC_rzr-cwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 08:53:21
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:53:15.545772 2026] [security2:error] [pid 32382:tid 32382] [client 170.64.222.174:26700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.app.fourminutedecision.com"] [uri "/.env"] [unique_id "as3xeyI2zVhAW7g-PV_oOAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
dispensight
2026-10-13 08:22:27
(4 days ago)
CMS/backup artefact probe. 12 request(s) against s01-app.dispensight.ca between 2026-10-13 01:22 and ...
show more
CMS/backup artefact probe. 12 request(s) against s01-app.dispensight.ca between 2026-10-13 01:22 and 2026-10-13 01:22 (America/Vancouver). Sample paths: /_ignition/execute-solution; /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php; /new. Observed on origin web logs + tunnel telemetry. Automated detection, manually reviewed. Reported by Dispensight/SecureLeaf.
show less
Web App Attack
Hacking
🇨🇭
YF
2026-10-13 07:07:17
(4 days ago)
Environment file probe
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 06:50:57
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.222.174 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 02:50:51.284636 2026] [security2:error] [pid 6403:tid 6403] [client 170.64.222.174:56568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.apothecarydc.swampoodlegrounds.com"] [uri "/.env"] [unique_id "as3Uy2FaKA1PCPRI3WnUTgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-10-13 06:39:31
(4 days ago)
Bad behaviour
Web Spam
🇮🇹
LTM
2026-10-13 06:20:01
(4 days ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack
🇵🇱
gandaflux
2026-10-13 06:00:56
(4 days ago)
170.64.222.174 [redacted-domain] - [13/Oct/2026:08:00:55 +0200] "POST /vendor/phpunit/phpunit/src/Ut ...
show more
170.64.222.174 [redacted-domain] - [13/Oct/2026:08:00:55 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
170.64.222.174 [redacted-domain] - [13/Oct/2026:08:00:55 +0200] "GET /.env HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
170.64.222.174 [redacted-domain] - [13/Oct/2026:08:00:55 +0200] "GET /.git/config HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-13 05:16:12
(4 days ago)
10 attacks on Laravel URLs, env grabbing URLs, site downloads (type 2), VC URLs, PHP URLs:
GET /_ign ...
show more
10 attacks on Laravel URLs, env grabbing URLs, site downloads (type 2), VC URLs, PHP URLs:
GET /_ignition/execute-solution HTTP/1.1
GET /.env HTTP/1.1
GET /demo HTTP/1.1
GET /.git/config HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
show less
Web App Attack
Hacking
🇩🇪
TheDjRider
2026-10-13 04:50:41
(4 days ago)
CrowdSec detected Known vulnerability exploitation attempt. Scenario: crowdsecurity/CVE-2017-9841. A ...
show more
CrowdSec detected Known vulnerability exploitation attempt. Scenario: crowdsecurity/CVE-2017-9841. Automatic ban triggered. Detection time (UTC): 2026-10-13T04:50:40.162719704Z. Context: http_status=503
show less
Hacking
Web App Attack
🇨🇦
Blinker73
2026-10-13 02:48:29
(4 days ago)
170.64.222.174 - - [12/Oct/2026:22:48:28 -0400] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windo ...
show more
170.64.222.174 - - [12/Oct/2026:22:48:28 -0400] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack