🇳🇱
homeshowdomain.nl
2026-11-08 23:02:14
UTC ·
(2 minutes ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-07.
Web App Attack
SSH
Hacking
🇫🇷
tecnicorioja
2026-11-08 23:01:34
UTC ·
(2 minutes ago)
(Mod_security)
Web App Attack
Brute-Force
Bad Web Bot
🇳🇱
Site.eu
2026-11-08 22:15:52
UTC ·
(48 minutes ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇰
floyd_dk
2026-11-08 21:41:22
UTC ·
(1 hour ago)
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env.anthropic HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env-sample HTTP/2.0" 404 153 "-" "Mozil ...
show more
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env.anthropic HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env-sample HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env-example HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.env HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.docker/laravel/app/.env HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.docker/config.json HTTP/2.0" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:21:41:22 +0000] "GET /.docker/.env HT
...
show less
Web App Attack
🇺🇸
CollideTech
2026-11-08 21:33:04
UTC ·
(1 hour ago)
probing for vulnerabilities
Web App Attack
Anonymous
2026-11-08 21:28:44
UTC ·
(1 hour ago)
[ABYNTIS Lagezentrum] Web vulnerability scanning between 2026-11-07 and 2026-11-08: 383 requests, 316 probes for sensitive paths (e.g. /.env.aws, /.env.dev, /.env.development, /.env.dist). Blocked automatically by rule-based detection.
Web App Attack
Port Scan
🇩🇪
sdos.es
2026-11-08 21:26:49
UTC ·
(1 hour ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env-example"
Web App Attack
🇺🇸
ip-reporting-by-FARROW
2026-11-08 21:22:30
UTC ·
(1 hour ago)
2026-11-07 18:50:17,650 fail2ban.actions [1094]: NOTICE [apache-noscript] Ban 207.175.237.228
2026-11-08 03:11:41,350 fail2ban.actions [1094]: NOTICE [apache-noscript] Ban 207.175.237.228
2026-11-08 16:22:29,431 fail2ban.actions ...
show more
2026-11-07 18:50:17,650 fail2ban.actions [1094]: NOTICE [apache-noscript] Ban 207.175.237.228
2026-11-08 03:11:41,350 fail2ban.actions [1094]: NOTICE [apache-noscript] Ban 207.175.237.228
2026-11-08 16:22:29,431 fail2ban.actions [1094]: NOTICE [apache-noscript] Ban 207.175.237.228
...
show less
Brute-Force
Exploited Host
🇺🇸
j8.cl
2026-11-08 21:05:35
UTC ·
(1 hour ago)
Repeated web application probes rejected by HTTP 4xx responses. Log UTC 2026-11-08T21:05:35Z: src=207.175.237.228 requests=27 rules=probe_env,probe_git. Pattern matches indicate probing attempts, not a confirmed compromise. URLs, payloads and account ...
show more
Repeated web application probes rejected by HTTP 4xx responses. Log UTC 2026-11-08T21:05:35Z: src=207.175.237.228 requests=27 rules=probe_env,probe_git. Pattern matches indicate probing attempts, not a confirmed compromise. URLs, payloads and account data redacted.
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-08 20:46:54
UTC ·
(2 hours ago)
[Mon Nov 09 07:46:53.854863 2026] [security2:error] [pid 27895] [client 207.175.237.228:58740] [client 207.175.237.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/R ...
show more
[Mon Nov 09 07:46:53.854863 2026] [security2:error] [pid 27895] [client 207.175.237.228:58740] [client 207.175.237.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "indigi-print-merch.com.au"] [uri "/.env.anthropic"] [unique_id "avDfvRCV9dcJ0Nm9DgVMhAAAABA"]
...
show less
Web App Attack
🇩🇪
tg_de
2026-11-08 20:24:28
UTC ·
(2 hours ago)
246 attempts since 07.11.2026 22:54:02 UTC - last search for: /sites/default/settings.local.php
Web App Attack
🇩🇪
NetShield-DE
2026-11-08 20:07:28
UTC ·
(2 hours ago)
Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb.
Events: 1. First: 2026-11-08T21:07:01+0100. Last: 2026-11-08T21:07:01+0100.
Samples:
- 2026-11-08 00:36:00,922 fail2ban.actions [855]: NOTICE [abuseipdb] Ban 207.175.237 ...
show more
Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb.
Events: 1. First: 2026-11-08T21:07:01+0100. Last: 2026-11-08T21:07:01+0100.
Samples:
- 2026-11-08 00:36:00,922 fail2ban.actions [855]: NOTICE [abuseipdb] Ban 207.175.237.228
show less
Web App Attack
🇫🇷
putputlaw
2026-11-08 19:54:43
UTC ·
(3 hours ago)
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env.anthropic HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env-sample HTTP/2.0" 404 146 "-" "Mozil ...
show more
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env.anthropic HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env-sample HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env-example HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
207.175.237.228 - - [08/Nov/2026:19:54:42 +0000] "GET /.env HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Web App Attack
🇫🇷
Quarks Solutions
2026-11-08 19:48:35
UTC ·
(3 hours ago)
crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
rhandorf
2026-11-08 16:19:51
UTC ·
(6 hours ago)
Multiple web server 400 error codes from same source ip. (224 events) - reported by a home network SIEM
Port Scan
Web App Attack