🇺🇸
helios.live
2026-10-13 15:16:20
(15 hours ago)
2026/10/13 15:11:16 [error] 737405#737405: *855815 access forbidden by rule, client: 2400:8907::2000 ...
show more
2026/10/13 15:11:16 [error] 737405#737405: *855815 access forbidden by rule, client: 2400:8907::2000:91ff:fe88:a037, server: kocerroxy.com, request: "GET /.env.example HTTP/1.1", host: "kocerroxy.com"
2026/10/13 15:11:53 [error] 737405#737405: *855815 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 2400:8907::2000:91ff:fe88:a037, server: kocerroxy.com, request: "GET /config/config.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com"
2400:8907::2000:91ff:fe88:a037 - - [13/Oct/2026:15:11:53 +0000] "GET /config/config.php HTTP/1.1" 404 47 "-" "python-requests/2.34.2"
2026/10/13 15:16:19 [error] 737405#737405: *855920 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 2400:8907::2000:91ff:fe88:a037, server: kocerroxy.com, request: "GET /spacef.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock
...
show less
Web App Attack
🇺🇸
deskpass.com
2026-10-13 11:29:21
(19 hours ago)
GET /spacef.php
Web App Attack
🇺🇸
deskpass.com
2026-10-13 11:09:22
(19 hours ago)
GET /vendor/phpunit/phpunit/src/Util/PHP/sys_cache.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 05:05:47
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:05:39.733492 2026] [security2:error] [pid 23010:tid 23010] [client 2400:8907::2000:91ff:fe88:a037:56325] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "persnicketyinc.com"] [uri "/.env"] [unique_id "as28Iyi7D7fqYDwj_B9gsQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-13 04:16:27
(1 day ago)
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2400:8907::2000:91ff:fe88:a037 - - [13/Oct/2026:06:16:25 +0200] "GET /.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 03:40:00
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 23:39:54.221781 2026] [security2:error] [pid 21805:tid 21805] [client 2400:8907::2000:91ff:fe88:a037:51343] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.legalnexuslawfirm.com"] [uri "/.env"] [unique_id "as2oCnD6KE2uWb0kiMRvdQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-13 03:38:30
(1 day ago)
Try to access /.env
Web App Attack
🇩🇪
pltcldvlpr
2026-10-13 03:14:49
(1 day ago)
CMS/framework probe: 2400:8907::2000:91ff:fe88:a037 - - [13/Oct/2026:05:14:49 +0200] "GET /.env HTTP ...
show more
CMS/framework probe: 2400:8907::2000:91ff:fe88:a037 - - [13/Oct/2026:05:14:49 +0200] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" asn=63949 org="Akamai Technologies, Inc." country=AU
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 03:01:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 23:01:45.639273 2026] [security2:error] [pid 3780:tid 3780] [client 2400:8907::2000:91ff:fe88:a037:50163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mohawkmunicipalcommission.org.mohawk-ny.org"] [uri "/.env"] [unique_id "as2fGauAsE2fgOX_WU4HwAAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇰
HostingGroup
2026-10-13 02:51:54
(1 day ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shiel ...
show more
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 1. First blocked: 2026-10-13.
show less
Bad Web Bot
Web App Attack
🇩🇪
HandyTreff.de
2026-10-13 02:47:41
(1 day ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -74.771 (Bad < -10 / Very Bad < -20 ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -74.771 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/5
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-13 02:11:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:8907::2000:91ff:fe88:a037 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:11:01.126764 2026] [security2:error] [pid 10095:tid 10095] [client 2400:8907::2000:91ff:fe88:a037:63279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.linguistes.com"] [uri "/.env"] [unique_id "as2TNYovhVAD6RD6EdJVEQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
