2026-03-19 00:11:09
UTC ·
(7 months ago)
<jail> banned by fail2ban
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-02-22 22:59:29
UTC ·
(8 months ago)
Auto-ban: >3000 req/min op 2026-02-22
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-02-22 07:33:58
UTC ·
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 02:33:51.039805 2026] [security2:error] [pid 29328:tid 29328] [client 170.64.231.112:11974] ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 02:33:51.039805 2026] [security2:error] [pid 29328:tid 29328] [client 170.64.231.112:11974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bryanthebusinessmanager.com"] [uri "/.env"] [unique_id "aZqxXzvwiX4FrLdG6uMWUwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-02-22 07:33:19
UTC ·
(8 months ago)
Blocking for trying to access an exploit file: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Hacking
🇺🇸
TPI-Abuse
2026-02-22 07:04:43
UTC ·
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 02:04:36.025514 2026] [security2:error] [pid 2689:tid 2689] [client 170.64.231.112:33882] M ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 02:04:36.025514 2026] [security2:error] [pid 2689:tid 2689] [client 170.64.231.112:33882] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bruskiewitz.com"] [uri "/.env"] [unique_id "aZqqhI7DZ0dexhYWeuHHFgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hary74656
2026-02-22 06:57:29
UTC ·
(8 months ago)
[Sun Feb 22 07:57:10.748144 2026] [security2:error] [pid 243612:tid 243669] [remote 170.64.231.112:1132] [client 170.64.231.112] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecu ...
show more
[Sun Feb 22 07:57:10.748144 2026] [security2:error] [pid 243612:tid 243669] [remote 170.64.231.112:1132] [client 170.64.231.112] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "brunt.weavernet.at"] [uri "/.env"] [unique_id "aZqoxk7201jindrwasPWJAACygI"]
[Sun Feb 22 07:57:10.750507 2026] [security2:error] [pid 243612:tid 243687] [remote 170.64.231.112:1132] [client 170.64.231.112] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.git/" at REQUEST_FILENAME. [file "/usr/share/
...
show less
Web App Attack
🇨🇭
zynex
2026-02-22 06:41:34
UTC ·
(8 months ago)
URL Probing: /.env
Web App Attack
🇳🇱
ConsulHosting
2026-02-22 06:19:24
UTC ·
(8 months ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇩🇪
SCHAPPY
2026-02-22 06:12:31
UTC ·
(8 months ago)
Probing for non-installed web apps or current vulnerabilities.
Hacking
Web App Attack
🇨🇭
Origon
2026-02-22 06:10:19
UTC ·
(8 months ago)
CVE-2017-9841 - IP: 170.64.231.112 - time="2026-02-22T07:10:19+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/CVE-2017-9841 by ip 170.64.231.112 (AU/14061) : 4h ban on Ip 170.64.231.112" module=db
Web App Attack
2026-02-22 06:07:48
UTC ·
(8 months ago)
<jail> banned by fail2ban
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-22 05:52:24
UTC ·
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 00:52:18.852763 2026] [security2:error] [pid 10366:tid 10366] [client 170.64.231.112:0] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 00:52:18.852763 2026] [security2:error] [pid 10366:tid 10366] [client 170.64.231.112:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brt.365soft.top"] [uri "/.env"] [unique_id "aZqZkgu7d4A6bPmWEIIehwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-22 05:50:02
UTC ·
(8 months ago)
suspicious request in access.log
Web App Attack
🇳🇱
vaddilyin
2026-02-22 05:35:23
UTC ·
(8 months ago)
{"ClientAddr":"170.64.231.112:38754","ClientHost":"170.64.231.112","ClientPort":"38754","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":38828,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"O ...
show more
{"ClientAddr":"170.64.231.112:38754","ClientHost":"170.64.231.112","ClientPort":"38754","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":38828,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":38828,"RequestAddr":"browserless.vdkln.com","RequestContentSize":0,"RequestCount":327980,"RequestHost":"browserless.vdkln.com","RequestMethod":"GET","RequestPath":"/.env","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"StartLocal":"2026-02-22T05:35:21.893833276Z","StartUTC":"2026-02-22T05:35:21.893833276Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-02-22T05:35:21Z"}
{"ClientAddr":"170.64.231.112:38754","ClientHost":"170.64.231.112","ClientPort":"38754","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":9269,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Ove
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-02-22 05:05:46
UTC ·
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 00:05:39.576233 2026] [security2:error] [pid 15802:tid 15802] [client 170.64.231.112:56120] ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.231.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 00:05:39.576233 2026] [security2:error] [pid 15802:tid 15802] [client 170.64.231.112:56120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "browingism.com"] [uri "/.env"] [unique_id "aZqOoy7T5NHt-vEJXeZgcwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack