🇧🇪
madeit
2026-11-07 12:43:47
UTC ·
(2 hours ago)
Web App Attack
🇧🇪
madeit
2026-09-26 07:49:24
UTC ·
(1 month ago)
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-05 22:01:36
UTC ·
(2 months ago)
Auto-ban: >3000 req/min op 2026-09-05
Web App Attack
SSH
Hacking
🇨🇿
sajmon0011
2026-08-30 16:13:25
UTC ·
(2 months ago)
172.70.175.31 - - [30/Aug/2026:18:13:23 +0200] "GET /.env.local HTTP/2.0" 404 196 "https://www.google.com/search?q=server1.sajmon0011.cz" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1 ...
show more
172.70.175.31 - - [30/Aug/2026:18:13:23 +0200] "GET /.env.local HTTP/2.0" 404 196 "https://www.google.com/search?q=server1.sajmon0011.cz" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Web App Attack
🇧🇪
madeit
2026-08-11 08:35:11
UTC ·
(2 months ago)
Web App Attack
2026-07-29 06:11:50
UTC ·
(3 months ago)
(caddyscan) Scanner path probe from 172.70.175.31 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /kafka/.env HTTP/1.1 ...
show more
(caddyscan) Scanner path probe from 172.70.175.31 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /kafka/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /worker/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /test/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /preview/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.175.31 - - [29/Jul/2026:06:11:48 +0000] "GET /uat/.env HTTP/1.1"
show less
Port Scan
2026-04-07 20:19:47
UTC ·
(6 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 01:03:17
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 21:03:09.772839 2026] [security2:error] [pid 3047:tid 3086] [client 172.70.175.31:11647] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 21:03:09.772839 2026] [security2:error] [pid 3047:tid 3086] [client 172.70.175.31:11647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.omegaoak.com"] [uri "/.env.dev"] [unique_id "adRXzZea40y5qwYuN5YFkwAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-05 09:02:30
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 05:02:19.621170 2026] [security2:error] [pid 3360:tid 3360] [client 172.70.175.31:14191] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 05:02:19.621170 2026] [security2:error] [pid 3360:tid 3360] [client 172.70.175.31:14191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.lucid-hq.com"] [uri "/.env.production"] [unique_id "adIlG1AQr-qdUvQhGtb76QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-05 06:02:54
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 02:02:49.525356 2026] [security2:error] [pid 11607:tid 11607] [client 172.70.175.31:12928] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 02:02:49.525356 2026] [security2:error] [pid 11607:tid 11607] [client 172.70.175.31:12928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "origenial.com"] [uri "/.env.old"] [unique_id "adH7CVGeOkA17unnnCBB_gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 18:20:55
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 14:20:50.026339 2026] [security2:error] [pid 4673:tid 4673] [client 172.70.175.31:11121] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 14:20:50.026339 2026] [security2:error] [pid 4673:tid 4673] [client 172.70.175.31:11121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.groovedoctors.com"] [uri "/private/.env"] [unique_id "adFWgoWoiSuUr7ypAxhzoAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 04:15:31
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 00:15:24.290595 2026] [security2:error] [pid 9682:tid 9682] [client 172.70.175.31:10987] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 00:15:24.290595 2026] [security2:error] [pid 9682:tid 9682] [client 172.70.175.31:10987] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.procigar.org"] [uri "/.env.php"] [unique_id "adCQXHUK4WOtCMyTFtZP8AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 12:52:15
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 08:52:07.788279 2026] [security2:error] [pid 21874:tid 21874] [client 172.70.175.31:13833] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 08:52:07.788279 2026] [security2:error] [pid 21874:tid 21874] [client 172.70.175.31:13833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kathrynmcbride.com"] [uri "/.env.dev"] [unique_id "ac-398lWnkd5j78fCP_0EgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 11:53:13
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 07:53:06.942862 2026] [security2:error] [pid 29783:tid 29783] [client 172.70.175.31:12151] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 07:53:06.942862 2026] [security2:error] [pid 29783:tid 29783] [client 172.70.175.31:12151] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cdsolutions.help"] [uri "/.env.local"] [unique_id "ac-qIn02vqBCmJbAoVP0qwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 03:32:03
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 23:31:57.319534 2026] [security2:error] [pid 19413:tid 19413] [client 172.70.175.31:11842] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.31 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 23:31:57.319534 2026] [security2:error] [pid 19413:tid 19413] [client 172.70.175.31:11842] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sbxyz.net"] [uri "/.env.orig"] [unique_id "ac80rV2WXI1jKHglruJ3ewAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
