🇫🇷
COMAITE
2026-11-07 06:18:39
UTC ·
(9 minutes ago)
Suspicious URL access.
Web App Attack
🇧🇷
borbolla
2026-11-07 05:05:53
UTC ·
(1 hour ago)
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET / HTTP/1.1" "GET /.env HTTP/1.1" "GET /.env.bak HTTP/1.1"
Web App Attack
Bad Web Bot
🇩🇪
Gwyneth Llewelyn
2026-11-07 04:47:41
UTC ·
(1 hour ago)
2026/11/07 04:47:38 [error] 3084#3084: *1476784 access forbidden by rule, client: 170.64.224.99, server: apcoelho.pt, request: "GET /.env HTTP/2.0", host: "www.apcoelho.pt"
170.64.224.99 - - [07/Nov/2026:04:47:38 +0000] "GET /.env HTTP/2.0" 403 1045 ...
show more
2026/11/07 04:47:38 [error] 3084#3084: *1476784 access forbidden by rule, client: 170.64.224.99, server: apcoelho.pt, request: "GET /.env HTTP/2.0", host: "www.apcoelho.pt"
170.64.224.99 - - [07/Nov/2026:04:47:38 +0000] "GET /.env HTTP/2.0" 403 1045 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
2026/11/07 04:47:40 [error] 3084#3084: *1476784 access forbidden by rule, client: 170.64.224.99, server: apcoelho.pt, request: "GET //.env HTTP/2.0", host: "www.apcoelho.pt"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 04:39:21
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:39:14.022122 2026] [security2:error] [pid 20151:tid 20151] [client 170.64.224.99:50160] M ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:39:14.022122 2026] [security2:error] [pid 20151:tid 20151] [client 170.64.224.99:50160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "argcreativegroup.com"] [uri "/.env"] [unique_id "au6rcpqKI2nc_WXFipJbggAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-07 01:50:52
UTC ·
(4 hours ago)
Excessive 404/403 errors
Brute-Force
🇷🇴
clauss
2026-11-07 00:22:44
UTC ·
(6 hours ago)
170.64.224.99 - - [07/Nov/2026:02:22:40 +0200] "GET /.env.bak HTTP/1.1" 401 36 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
170.64.224.99 - - [07/Nov/2026:02:22:40 +0200] "GET /.env.old H ...
show more
170.64.224.99 - - [07/Nov/2026:02:22:40 +0200] "GET /.env.bak HTTP/1.1" 401 36 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
170.64.224.99 - - [07/Nov/2026:02:22:40 +0200] "GET /.env.old HTTP/1.1" 401 36 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 00:07:00
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:06:55.271708 2026] [security2:error] [pid 20701:tid 20701] [client 170.64.224.99:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 19:06:55.271708 2026] [security2:error] [pid 20701:tid 20701] [client 170.64.224.99:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.caspina.com"] [uri "/.env"] [unique_id "au5rn4ZxOFyUDmMm3SUvHAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 17:10:48
UTC ·
(13 hours ago)
IP matched detection query 404 icewarp.
Brute-Force
Hacking
🇺🇸
TPI-Abuse
2026-11-06 13:32:56
UTC ·
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:32:51.080647 2026] [security2:error] [pid 3310:tid 3310] [client 170.64.224.99:42570] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:32:51.080647 2026] [security2:error] [pid 3310:tid 3310] [client 170.64.224.99:42570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.cwchamber.com"] [uri "/.env"] [unique_id "au3XA7ibo5yia4aL-EF1wgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 12:20:46
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:20:38.831132 2026] [security2:error] [pid 9114:tid 9132] [client 170.64.224.99:42518] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.224.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:20:38.831132 2026] [security2:error] [pid 9114:tid 9132] [client 170.64.224.99:42518] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.paylessformedicine.com"] [uri "/.env"] [unique_id "au3GFm6tjt8gIGd6wJQm8gAAAM0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-11-06 12:08:18
UTC ·
(18 hours ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-06 12:08 UTC.
Bad Web Bot
Web App Attack
🇩🇪
akasolutions.de
2026-11-06 06:58:16
UTC ·
(23 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 170.64.224.99 (AU/Australia/-)
SQL Injection
🇳🇱
Alt255
2026-11-06 03:00:11
UTC ·
(1 day ago)
[ti-29al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 170.64.224.99 - - [06/Nov/2026:04:00:07 +0100] "GET /.env HTTP/1.1" 404 7586 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like ...
show more
[ti-29al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 170.64.224.99 - - [06/Nov/2026:04:00:07 +0100] "GET /.env HTTP/1.1" 404 7586 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-06 02:12:58
UTC ·
(1 day ago)
Multiple WAF Violations
Web App Attack
🇮🇪
AutosOnShow
2026-11-05 21:45:07
UTC ·
(1 day ago)
blocked for webapp attack | path requested: /laravel/.env | seen at 2026-11-05 21:44:36.616 |
Web App Attack
