🇳🇱
homeshowdomain.nl
2026-07-26 22:04:26
(11 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-25.
show less
Web App Attack
SSH
Hacking
🇳🇱
homeshowdomain.nl
2026-07-25 22:01:15
(1 day ago)
Auto-ban: >3000 req/min op 2026-07-25
Web App Attack
SSH
Hacking
2026-07-25 11:49:28
(1 day ago)
(caddyscan) Scanner path probe from 18.220.144.236 (US/United States/ec2-18-220-144-236.us-east-2.co ...
show more
(caddyscan) Scanner path probe from 18.220.144.236 (US/United States/ec2-18-220-144-236.us-east-2.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 18.220.144.236 - - [25/Jul/2026:11:49:24 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 18.220.144.236 - - [25/Jul/2026:11:49:24 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 18.220.144.236 - - [25/Jul/2026:11:49:24 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 18.220.144.236 - - [25/Jul/2026:11:49:24 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 18.220.144.236 - - [25/Jul/2026:11:49:24 +0000] "GET /.env.staging HTTP/1.1"
show less
Port Scan
🇩🇪
bancix
2026-07-25 03:07:06
(2 days ago)
2026/07/25 05:07:06 [error] 1172855#1172855: *144413 FastCGI sent in stderr: "Primary script unknown ...
show more
2026/07/25 05:07:06 [error] 1172855#1172855: *144413 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
2026/07/25 05:07:06 [error] 1172855#1172855: *144413 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /php.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
2026/07/25 05:07:06 [error] 1172855#1172855: *144413 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /i.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
...
show less
DDoS Attack
Email Spam
Port Scan
Spoofing
Brute-Force
SSH
🇳🇱
Savvii
2026-07-25 02:26:08
(2 days ago)
20 attempts against mh-misbehave-ban on pf102930
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-07-25 00:06:22
(2 days ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-07-24 13:58:39
(2 days ago)
15 attempts against mh-modsecurity-ban on shelf
Brute-Force
Web App Attack
🇩🇪
IVski
2026-07-24 07:50:36
(3 days ago)
IVski WAF | Sensitive file probe detected - looking for .git
Port Scan
Brute-Force
Web App Attack
🇩🇪
bancix
2026-07-24 06:45:36
(3 days ago)
2026/07/24 08:45:35 [error] 1044733#1044733: *110028 FastCGI sent in stderr: "Primary script unknown ...
show more
2026/07/24 08:45:35 [error] 1044733#1044733: *110028 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
2026/07/24 08:45:35 [error] 1044733#1044733: *110028 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /php.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
2026/07/24 08:45:36 [error] 1044733#1044733: *110028 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 18.220.144.236, server: site.cislveneto.it, request: "GET /i.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.2-fpm.sock:", host: "site.cislveneto.it"
...
show less
DDoS Attack
Email Spam
Port Scan
Spoofing
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-24 06:09:41
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 18.220.144.236 (ec2-18-220-144-236.us-east-2.co ...
show more
(mod_security) mod_security (id:210492) triggered by 18.220.144.236 (ec2-18-220-144-236.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:09:37.383311 2026] [security2:error] [pid 365228:tid 365228] [client 18.220.144.236:58390] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "site.ablogisticsgroup.com"] [uri "/.git/config"] [unique_id "amMBoaVabf8NDAVkTD9zbgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-07-24 06:01:15
(3 days ago)
20 attempts against mh_ha-misbehave-ban on pf102930
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-07-24 05:23:41
(3 days ago)
Try to access /.git/config
Web App Attack