🇬🇧
Aetherweb Ark
2026-05-16 00:10:50
(2 weeks ago)
(mod_security) mod_security (id:949110) triggered by 208.84.100.201 (US/United States/-): N in the l ...
show more
(mod_security) mod_security (id:949110) triggered by 208.84.100.201 (US/United States/-): N in the last X secs
show less
Web App Attack
2026-05-15 23:36:23
(2 weeks ago)
208.84.100.201 - - [16/May/2026:01:36:18 +0200] "GET /.wp-config.php.swp HTTP/1.0" 404 54261 "-" "Mo ...
show more
208.84.100.201 - - [16/May/2026:01:36:18 +0200] "GET /.wp-config.php.swp HTTP/1.0" 404 54261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0"
208.84.100.201 - - [16/May/2026:01:36:22 +0200] "GET /.wp-config.php.swp HTTP/1.1" 404 12308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0"
208.84.100.201 - - [16/May/2026:01:36:18 +0200] "GET /wp-config.php~ HTTP/1.0" 404 54261 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
208.84.100.201 - - [16/May/2026:01:36:22 +0200] "GET /wp-config.php~ HTTP/1.1" 404 12308 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
208.84.100.201 - - [16/May/2026:01:36:18 +0200] "GET /wp-config.php.save HTTP/1.0" 404 54261 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇩🇪
Vegascosmetics
2026-05-15 21:50:22
(2 weeks ago)
Kingcopy(AI-IDS):IP does Multiple AWS Environment Abuse
Hacking
Web App Attack
🇺🇦
URAN Publishing Service
2026-05-15 21:03:24
(2 weeks ago)
208.84.100.201 - - [16/May/2026:00:03:22 +0300] "GET /api/.env HTTP/1.1" 404 3330 "-" "Mozilla/5.0 ( ...
show more
208.84.100.201 - - [16/May/2026:00:03:22 +0300] "GET /api/.env HTTP/1.1" 404 3330 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15"
208.84.100.201 - - [16/May/2026:00:03:22 +0300] "GET /.env HTTP/1.1" 404 3277 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0"
...
show less
Web App Attack
🇭🇺
DumaNet
2026-05-15 19:35:00
(2 weeks ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 May 15. 18:17:22
Source IP: 208.84 ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 May 15. 18:17:22
Source IP: 208.84.100.201
Portion of the log(s):
208.84.100.201 - [15/May/2026:18:17:19 +0200] "GET /wp-content/debug.log HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
208.84.100.201 - [15/May/2026:18:17:19 +0200] "GET /service-account.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
208.84.100.201 - [15/May/2026:18:17:19 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 153 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1"
208.84.100.201 - [15/May/2026:18:17:19 +0200] "GET /firebase-service-account.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
show less
Web App Attack
Hacking
🇩🇪
paissangroup
2026-05-15 17:34:55
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇩🇪
FeG Deutschland
2026-05-15 17:17:59
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇱🇻
garmtech.com
2026-05-15 15:59:14
(2 weeks ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇦
URAN Publishing Service
2026-05-15 15:55:56
(2 weeks ago)
208.84.100.201 - - [15/May/2026:18:55:55 +0300] "GET /backend/.env HTTP/1.1" 404 3044 "-" "Mozilla/5 ...
show more
208.84.100.201 - - [15/May/2026:18:55:55 +0300] "GET /backend/.env HTTP/1.1" 404 3044 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
...
show less
Web App Attack
2026-05-15 15:40:06
(2 weeks ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇲🇾
Rizzy
2026-05-15 15:20:58
(2 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
Starburst SysOp Team
2026-05-15 15:11:34
(2 weeks ago)
Restricted File Access Attempt. Matched phrase "secrets.json" at REQUEST_FILENAME. (930130-mnz6-1)
Hacking
Web App Attack
🇧🇬
pa4080
2026-05-15 10:27:16
(2 weeks ago)
Detected by ModSecurity. Request URI: /.env
Web App Attack
🇩🇪
maxpower
2026-05-15 10:25:51
(2 weeks ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 208.84.100.201 (US/United States/-): 1 i ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 208.84.100.201 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 208.84.100.201 - - [15/May/2026:12:25:45 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" "-" host=maylynlopez.com
show less
Port Scan
🇧🇷
Halux
2026-05-15 09:18:09
(2 weeks ago)
208.84.100.201 Probing protected path or service
Web App Attack