|
🇳🇱
Alt255
|
|
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [30/Sep/2026:12:37:40 +0200] "GET /.env.old HTTP/1.1" 404 1483491 "https://yellow-star-008e.sal3z21c.workers.dev/proxy?modify&p ...
show more
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [30/Sep/2026:12:37:40 +0200] "GET /.env.old HTTP/1.1" 404 1483491 "https://yellow-star-008e.sal3z21c.workers.dev/proxy?modify&proxyUrl=http%3A%2F%2Fwww.true-groove.com%2F.env.old" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
...
show less
|
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
178.128.20.53 - - [30/Sep/2026:18:35:45 +0800] "GET /.env.production HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
...
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
e.fierstra
|
|
ModSecurity hits exceeded
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [21/Sep/2026:09:04:47 +0200] "GET /.env.save HTTP/1.1" 404 80348 "https://www.google.com/search?q=hoekwerk.com" "Mozilla/5.0 Ap ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [21/Sep/2026:09:04:47 +0200] "GET /.env.save HTTP/1.1" 404 80348 "https://www.google.com/search?q=hoekwerk.com" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [19/Sep/2026:10:53:28 +0200] "GET /tochten/driemasterzeilen-naar-pampus/.env.old HTTP/2.0" 404 123482 "https://crimson-fog-3e36 ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 178.128.20.53 - - [19/Sep/2026:10:53:28 +0200] "GET /tochten/driemasterzeilen-naar-pampus/.env.old HTTP/2.0" 404 123482 "https://crimson-fog-3e36.g4q2m6oa.workers.dev/proxy?modify&proxyUrl=https%3A%2F%2Fwww.zeilen-ijsselmeer.nl%2F.env.old" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 00:35:58.372137 2026] [security2:error] [pid 20564:tid 20564] [client 178.128.20.53:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 00:35:58.372137 2026] [security2:error] [pid 20564:tid 20564] [client 178.128.20.53:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.topsecret-si.com.f4fbbs.com"] [uri "/.env.backup"] [unique_id "aq4RLqb_VRaCuNayr68M5gAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
Web App Attack
|
Brute-Force
Exploited Host
Web App Attack
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-09.
|
Web App Attack
SSH
Hacking
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: >3000 req/min op 2026-09-09
|
Web App Attack
SSH
Hacking
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 07:27:57.005173 2026] [security2:error] [pid 24928:tid 24928] [client 178.128.20.53:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 07:27:57.005173 2026] [security2:error] [pid 24928:tid 24928] [client 178.128.20.53:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "babynapkins.com"] [uri "/.env"] [unique_id "ap_xPT2_mG41WsYM_ang4gAAAAE"], referer: https://www.google.com/search?q=babynapkins.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 08:00:53.231292 2026] [security2:error] [pid 9597:tid 9597] [client 178.128.20.53:0] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.20.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 07 08:00:53.231292 2026] [security2:error] [pid 9597:tid 9597] [client 178.128.20.53:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coralseasbeach.com"] [uri "/.env.bak"] [unique_id "ap6ndRfkIYe4VhZYIu5eJwAAAA0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
Packets-Decreaser.NET
|
|
Incoming Layer 7 Flood Detected
|
DDoS Attack
Web Spam
|
|
🇬🇧
quarba
|
|
Brute force SMTP login attempted.
...
|
Brute-Force
|
