🇩🇪
FeG Deutschland
2026-06-15 13:40:52
(33 minutes ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇳🇱
tmiland
2026-06-15 12:50:26
(1 hour ago)
(nginx_404) Dot directory Honeypot Trap 208.84.101.55 (US/United States/-): 2 in the last 3600 secs; ...
show more
(nginx_404) Dot directory Honeypot Trap 208.84.101.55 (US/United States/-): 2 in the last 3600 secs; IP: 208.84.101.55; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 208.84.101.55 - - [15/Jun/2026:14:50:25 +0200] "GET /.env.development HTTP/1.1" 404 2992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" 208.84.101.55 - - [15/Jun/2026:14:50:25 +0200] "GET /.env HTTP/1.1" 404 2992 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
show less
Brute-Force
🇩🇪
mr.joecat
2026-06-15 12:26:51
(1 hour ago)
208.84.101.55 - - [15/Jun/2026:14:26:49 +0200] "GET /wp-content/debug.log HTTP/1.1" 404 555 "-" "Moz ...
show more
208.84.101.55 - - [15/Jun/2026:14:26:49 +0200] "GET /wp-content/debug.log HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0"
208.84.101.55 - - [15/Jun/2026:14:26:50 +0200] "GET /config/default.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
208.84.101.55 - - [15/Jun/2026:14:26:50 +0200] "GET /config/production.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
208.84.101.55 - - [15/Jun/2026:14:26:50 +0200] "GET /config/service-account.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
208.84.101.55 - - [15/Jun/2026:14:26:50 +0200] "GET /.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5
...
show less
Web App Attack
🇳🇱
SysAdmin Dylan
2026-06-15 11:44:24
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (US/United States/-): 10 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (US/United States/-): 10 in the last 3600 secs
show less
Brute-Force
🇩🇪
strxmpp
2026-06-15 11:23:35
(2 hours ago)
208.84.101.55 - - [15/Jun/2026:13:23:35 +0200] "GET /.env.backup HTTP/1.1" 404 5797 "-" "Mozilla/5.0 ...
show more
208.84.101.55 - - [15/Jun/2026:13:23:35 +0200] "GET /.env.backup HTTP/1.1" 404 5797 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Bad Web Bot
2026-06-15 11:14:59
(2 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 10:52:28
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 06:52:24.720559 2026] [security2:error] [pid 10520:tid 10520] [client 208.84.101.55:35930] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fixitsmart.kronrod.com"] [uri "/.git/refs/heads/main"] [unique_id "ai_ZaLaA4bAAZikuM8UMZQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-06-15 09:50:03
(4 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 09:23:07
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:23:01.693601 2026] [security2:error] [pid 24315:tid 24315] [client 208.84.101.55:51440] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.keltingnet.scothart.com"] [uri "/.env.production.copy"] [unique_id "ai_EdR6RBJw2UNnbvMOFHQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-06-15 06:19:27
(7 hours ago)
Web App Attack
Web App Attack
2026-06-15 06:01:51
(8 hours ago)
Requested unexistent endpoint (Wordpress login, etc.)
Web App Attack
🇩🇪
SwinT
2026-06-15 06:00:05
(8 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 05:20:35
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 01:20:29.535717 2026] [security2:error] [pid 15805:tid 15805] [client 208.84.101.55:48196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.coopstehedwidge.com"] [uri "/.env"] [unique_id "ai-LndDS-plZqFHr_BPVmQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Choice Tech LLC
2026-06-15 05:00:02
(9 hours ago)
Blocked by OPNsense firewall; 14 hits, proto=tcp, ports=443,80
Port Scan
Hacking
🇩🇪
Viveronese
2026-06-15 02:54:26
(11 hours ago)
HTTP vulnerability scanning
Web App Attack