๐ฎ๐ณ
evicky2002
2026-06-23 05:52:11
(2 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
๐ง๐ท
Peregrine
2026-05-16 03:22:51
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-15 03:17:47
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-13 03:24:20
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-11 03:17:56
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-09 03:22:11
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-08 03:18:10
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ง๐ท
Peregrine
2026-05-06 03:21:53
(3 months ago)
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:1 ...
show more
Fail2Ban Jail s2: tomcat-honeypot | Evidence: 2a0b:8bc0:2:7640::1 172.71.95.98 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.local HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /laravel/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.102.39 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.production HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 162.159.113.127 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.bak HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 141.101.76.190 - - [28/Apr/2026:10:19:45 -0300] "GET /.aws/credentials HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 104.23.172.105 - - [28/Apr/2026:10:19:45 -0300] "GET /backend/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.99.240 - - [28/Apr/2026:10:19:45 -0300] "GET /api/.env HTTP/1.1" 404 414
2a0b:8bc0:2:7640::1 172.71.95.83 - - [28/Apr/2026:10:19:45 -0300] "GET /.env.backup HTTP/1.1" 404 414
show less
Bad Web Bot
๐ฉ๐ช
4server
2026-05-05 16:11:39
(3 months ago)
[TueMay0518:11:35.9363182026][security2:error][pid2020296:tid2020422][client2a0b:8bc0:2:7640::1:0]Mo ...
show more
[TueMay0518:11:35.9363182026][security2:error][pid2020296:tid2020422][client2a0b:8bc0:2:7640::1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"gpwealth.ch\"][uri\"/app/.env\"][unique_id\"afoWt9b2GmQ_qJ-fY1PeFAAAAQ4\"]
show less
Port Scan
Brute-Force
Web App Attack
Anonymous
2026-05-05 03:14:18
(3 months ago)
2a0b:8bc0:2:7640::1 - - [05/May/2026:11:14:18 +0800] "GET /app/.env HTTP/1.1" 200 19012 "-" "Mozilla ...
show more
2a0b:8bc0:2:7640::1 - - [05/May/2026:11:14:18 +0800] "GET /app/.env HTTP/1.1" 200 19012 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
๐ซ๐ท
dynamix
2026-05-05 02:27:56
(3 months ago)
Multiple WAF Violations
Web App Attack
๐ฉ๐ช
expandmade.com
2026-05-04 22:30:35
(3 months ago)
trolling for installation vulnerabilities [04/May/2026:22:30:35 "GET /api/.env"]
Web App Attack
๐น๐ท
baku.hosting
2026-05-04 18:01:39
(3 months ago)
CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 2a0b:8bc0:2:7640::1 (Unknown): ...
show more
CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 2a0b:8bc0:2:7640::1 (Unknown): 5 in the last 3600 secs
show less
Brute-Force
Web App Attack
๐ฉ๐ช
SCHAPPY
2026-05-04 18:00:18
(3 months ago)
Malicious activity from IP detected: crowdsecurity/http-sensitive-files.
Web App Attack
Hacking
๐ณ๐ฑ
e.fierstra
2026-05-04 16:23:06
(3 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack