2026-07-29 07:00:00
(2 days ago)
Apache probe; attempts=1126; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup1/ | /. ...
show more
Apache probe; attempts=1126; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup1/ | /.env.backup2 | /.env.backup2/ | /.env.backup/ | /.env.bak | /.env.bak/ | /.env.ci | /.env.ci/ | /.env.dev | /.env.dev/ | /.env.development | /.env.development/ | /.env.dist | /.env.dist/ | /.env.docker | /.env.docker/ | /.env.example | /.env.example/ | /.env.json | /.env.json/ | /.env.live | /.env.live/ | /.env.local | /.env.local/ | /.env.old | /.env.old/ | /.env.preprod | /.env.preprod/ | /.env.prod | /.env.prod/ | /.env.production | /.env.production/ | /.env.remote | /.env.remote/ | /.env.sample | /.env.sample/ | /.env.save | /.env.save/ | /.env.stage | /.env.stage/ | /.env.staging | /.env.staging/ | /.env.swp | /.env.swp/ | /.env.test | /.env.test/ | /.env.txt | /.env.txt/ | /.env.uat | /.env.uat/ | /.env.yaml | /.env.yaml/ | /.env.yml | /.env.yml/ | /.env/ | /.env~ | /.env~/ | /.git/.env | /.git/.env/ | /.g | ... [408 exact paths total]
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 09:16:53
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.comp ...
show more
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 05:16:47.942236 2026] [security2:error] [pid 4031050:tid 4031050] [client 18.217.31.125:60678] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.softwarezz.net"] [uri "/.git/config"] [unique_id "amch_-eMQ6Kx0q4Yq-9NVAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-26 12:16:56
(5 days ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇳🇱
Mangelot Hosting
2026-07-26 09:38:53
(5 days ago)
(php_susp_dir) srv101 PHP Suspicious Directory 18.217.31.125 (US/United States/ec2-18-217-31-125.us- ...
show more
(php_susp_dir) srv101 PHP Suspicious Directory 18.217.31.125 (US/United States/ec2-18-217-31-125.us-east-2.compute.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇳🇱
e.fierstra
2026-07-26 07:48:00
(5 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-07-26 06:05:12
(5 days ago)
Scanning/Probing (78)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 03:21:34
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.comp ...
show more
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 23:21:26.023056 2026] [security2:error] [pid 1039597:tid 1039597] [client 18.217.31.125:50546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.somaflow.okwellbeing.com"] [uri "/.git/config"] [unique_id "amV9NkwiqOo2v_cCmG4vWwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 07:01:15
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.comp ...
show more
(mod_security) mod_security (id:210730) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 03:01:06.896140 2026] [security2:error] [pid 537651:tid 537651] [client 18.217.31.125:45586] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.skinbot.rustyog.net|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.skinbot.rustyog.net"] [uri "/.env.bak"] [unique_id "amRfMr41vKSxAjXKn7kZWAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-25 05:05:31
(6 days ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41
Port Scan
🇸🇪
vaia.cloud
2026-07-25 04:45:03
(6 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
2026-07-25 00:05:13
(1 week ago)
2026/07/25 02:05:13 [error] 118375#118375: *58136 access forbidden by rule, client: 18.217.31.125, s ...
show more
2026/07/25 02:05:13 [error] 118375#118375: *58136 access forbidden by rule, client: 18.217.31.125, server: siteguide.co.za, request: "GET /.git/config HTTP/1.1", host: "siteguide.co.za"
2026/07/25 02:05:13 [error] 118375#118375: *58136 access forbidden by rule, client: 18.217.31.125, server: siteguide.co.za, request: "GET /.env HTTP/1.1", host: "siteguide.co.za"
2026/07/25 02:05:13 [error] 118375#118375: *58136 access forbidden by rule, client: 18.217.31.125, server: siteguide.co.za, request: "GET /.env.local HTTP/1.1", host: "siteguide.co.za"
...
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-07-24 21:59:07
(1 week ago)
Auto-ban: >3000 req/min op 2026-07-24
Web App Attack
SSH
Hacking
🇺🇸
rsa
2026-07-24 14:53:00
(1 week ago)
GET /cloud/.env HTTP/1.1
GET /newsletter/.env HTTP/1.1
GET /k8s/.env HTTP/1.1
DDoS Attack
Brute-Force
Exploited Host
Web App Attack
Hacking
🇳🇱
Site.eu
2026-07-24 12:33:36
(1 week ago)
Excessive 404/403 errors
Brute-Force
🇺🇸
TPI-Abuse
2026-07-24 09:23:01
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.comp ...
show more
(mod_security) mod_security (id:210492) triggered by 18.217.31.125 (ec2-18-217-31-125.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:22:57.559268 2026] [security2:error] [pid 3621118:tid 3621118] [client 18.217.31.125:45732] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.chipnado.fractalsky.com"] [uri "/.git/config"] [unique_id "amMu8bAQVoECH6dmO1AuKAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack