🇮🇳
evicky2002
2026-11-10 10:17:39
UTC ·
(2 hours ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇫🇷
tecnoacquisti.com
2026-11-10 10:01:38
UTC ·
(2 hours ago)
PrestaShop Security Module: suspicious probe path detected (/phpinfo.php)
Web App Attack
🇯🇵
warudora
2026-11-09 23:15:56
UTC ·
(13 hours ago)
Automated Honeypot Trap: Attempted to access sensitive path '/.gitconfig' on a Flask server.
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-09 22:59:17
UTC ·
(13 hours ago)
Auto-ban: >3000 req/min op 2026-11-09
Web App Attack
SSH
Hacking
🇳🇱
Alt255
2026-11-09 16:12:40
UTC ·
(20 hours ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a0f:ca80:b00b:1d9b::5 - - [09/Nov/2026:17:12:05 +0100] "GET / HTTP/2.0" 200 18893 "http://de-stoomboot.eu/composer.json" "Mozilla/5.0 (Windows N ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a0f:ca80:b00b:1d9b::5 - - [09/Nov/2026:17:12:05 +0100] "GET / HTTP/2.0" 200 18893 "http://de-stoomboot.eu/composer.json" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 15:22:09
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a0f:ca80:b00b:1d9b::5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:22:06.066642 2026] [security2:error] [pid 19370:tid 19370] [client 2a0f:ca ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0f:ca80:b00b:1d9b::5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:22:06.066642 2026] [security2:error] [pid 19370:tid 19370] [client 2a0f:ca80:b00b:1d9b::5:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uni-plan.com"] [uri "/.env-config.js"] [unique_id "avHlHhfFLhOTy7MN4VhLpQAAAB0"], referer: http://uni-plan.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-11-09 15:03:46
UTC ·
(21 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-11-09 09:23:10
UTC ·
(1 day ago)
[MonNov0910:23:03.9248212026][security2:error][pid2598950:tid2599061][client2a0f:ca80:b00b:1d9b::5:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQU ...
show more
[MonNov0910:23:03.9248212026][security2:error][pid2598950:tid2599061][client2a0f:ca80:b00b:1d9b::5:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"annunci-ticino.ch\"][uri\"/.aws/credentials\"][unique_id\"avGQ99PxWb3s9cH9MwYRogAAAME\"]\,referer:http://annunci-ticino.ch/
show less
Hacking
Web App Attack
🇩🇪
macrob
2026-11-09 07:57:55
UTC ·
(1 day ago)
2026/11/09 07:57:54 [error] 1295371#1295371: *18823908 access forbidden by rule, client: 2a0f:ca80:b00b:1d9b::5, server: finami.mx, request: "GET /.env.example HTTP/2.0", host: "finami.mx", referrer: "http://finami.mx/.env.example"
2026/11/09 07:57:5 ...
show more
2026/11/09 07:57:54 [error] 1295371#1295371: *18823908 access forbidden by rule, client: 2a0f:ca80:b00b:1d9b::5, server: finami.mx, request: "GET /.env.example HTTP/2.0", host: "finami.mx", referrer: "http://finami.mx/.env.example"
2026/11/09 07:57:54 [error] 1295370#1295370: *18818372 access forbidden by rule, client: 2a0f:ca80:b00b:1d9b::5, server: finami.mx, request: "GET /.env.development HTTP/2.0", host: "finami.mx", referrer: "http://finami.mx/.env.development"
2026/11/09 07:57:54 [error] 1295374#1295374: *18824893 access forbidden by rule, client: 2a0f:ca80:b00b:1d9b::5, server: finami.mx, request: "GET /.env.test HTTP/2.0", host: "finami.mx", referrer: "http://finami.mx/.env.test"
...
show less
Web App Attack
🇫🇮
stinpriza
2026-11-08 23:09:30
UTC ·
(1 day ago)
Web App Attack
Web App Attack
🇮🇹
VHosting
2026-11-08 21:25:03
UTC ·
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-11-08 20:01:46
UTC ·
(1 day ago)
2.106 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇩🇪
tall1oN
2026-11-08 14:44:35
UTC ·
(1 day ago)
2a0f:ca80:b00b:1d9b::5 - - [08/Nov/2026:15:44:34 +0100] "GET /.env.js HTTP/2.0" 200 669 "http://zockerbuden-community.de/.env.js" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" ...
show more
2a0f:ca80:b00b:1d9b::5 - - [08/Nov/2026:15:44:34 +0100] "GET /.env.js HTTP/2.0" 200 669 "http://zockerbuden-community.de/.env.js" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" "diamondliferp.cc"
2a0f:ca80:b00b:1d9b::5 - - [08/Nov/2026:15:44:34 +0100] "GET /.env HTTP/2.0" 200 669 "http://zockerbuden-community.de/.env" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "diamondliferp.cc"
...
show less
Web App Attack
Port Scan
Hacking
🇫🇷
HerrWolf
2026-11-08 10:00:05
UTC ·
(2 days ago)
CrowdSec Detection: crowdsecurity/http-admin-interface-probing
Web App Attack
2026-11-08 08:25:44
UTC ·
(2 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
