🇬🇧
andypiper
2026-06-16 01:02:30
(13 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-06-16 00:13:17
(14 hours ago)
Abuse Detected (2)
Brute-Force
Web App Attack
🇦🇺
2000cn.com.au
2026-06-15 17:17:40
(21 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
2026-06-15 17:11:26
(21 hours ago)
2026/06/15 14:11:25 [error] 2148#2148: *36566 access forbidden by rule, client: 27.112.79.9, server: ...
show more
2026/06/15 14:11:25 [error] 2148#2148: *36566 access forbidden by rule, client: 27.112.79.9, server: temcomercio.com.br, request: "GET /api/.env HTTP/1.1", host: "temcomercio.com.br"
2026/06/15 14:11:25 [error] 2148#2148: *36567 access forbidden by rule, client: 27.112.79.9, server: temcomercio.com.br, request: "GET /config/.env HTTP/1.1", host: "temcomercio.com.br"
2026/06/15 14:11:25 [error] 2148#2148: *36568 access forbidden by rule, client: 27.112.79.9, server: temcomercio.com.br, request: "GET /.env HTTP/1.1", host: "temcomercio.com.br"
...
show less
Port Scan
🇩🇪
onlyops.app
2026-06-15 17:00:04
(21 hours ago)
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-mods ...
show more
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-modsecurity jail) | onlyops.app
show less
Exploited Host
🇩🇪
bescared
2026-06-15 16:48:39
(21 hours ago)
F2B - Malicious activity detected. URL Probing. -8ff06ede-
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 16:10:00
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:09:55.780938 2026] [security2:error] [pid 19354:tid 19354] [client 27.112.79.9:39674] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "billhoy.com"] [uri "/config/.env"] [unique_id "ajAj06FXaGOzSOyCdm50LwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-15 08:58:34
(1 day ago)
27.112.79.9 - - [15/Jun/2026:11:58:33 +0300] "GET /.env HTTP/1.1" 404 456 "-" "Go-http-client/1.1"
2 ...
show more
27.112.79.9 - - [15/Jun/2026:11:58:33 +0300] "GET /.env HTTP/1.1" 404 456 "-" "Go-http-client/1.1"
27.112.79.9 - - [15/Jun/2026:11:58:34 +0300] "GET /.env HTTP/1.1" 404 3028 "-" "Go-http-client/1.1"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 08:52:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 04:52:15.262561 2026] [security2:error] [pid 14815:tid 14815] [client 27.112.79.9:51214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ctemdr.com"] [uri "/.env"] [unique_id "ai-9P_tuG9x9tRBshOX9HQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
Halux
2026-06-15 08:46:55
(1 day ago)
27.112.79.9 Probing protected path or service
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 08:36:34
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 27.112.79.9 (ip27-112-79-9.cloudhost.web.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 04:36:26.856754 2026] [security2:error] [pid 21614:tid 21614] [client 27.112.79.9:57938] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ifmamasang.com"] [uri "/.env"] [unique_id "ai-5imh52eO2l3fifujzKQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 08:34:40
(1 day ago)
27.112.79.9 - - [15/Jun/2026:10:34:40 +0200] "GET /.env HTTP/1.1" 301 169 "-" "Go-http-client/1.1"
Web App Attack
🇺🇸
sargetun
2026-06-04 07:55:23
(1 week ago)
Honeypot: Auto-ban: 24 hour idle after honeypot interaction. Auto-reported from VPS honeypot.
Brute-Force
SSH
Hacking
🇩🇪
DocNetzwerk
2026-06-04 03:24:59
(1 week ago)
(PERMBLOCK) 27.112.79.9 (ID/Indonesia/ip27-112-79-9.cloudhost.web.id) has had more than 3 temp block ...
show more
(PERMBLOCK) 27.112.79.9 (ID/Indonesia/ip27-112-79-9.cloudhost.web.id) has had more than 3 temp blocks
show less
Hacking
🇩🇪
LRob.fr
2026-06-04 00:45:11
(1 week ago)
FTP brute-force attack detected by Fail2Ban in plesk-proftpd jail
FTP Brute-Force