🇳🇱
homeshowdomain.nl
2026-11-03 23:01:22
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-02.
Web App Attack
SSH
Hacking
🇺🇸
dot.mg
2026-11-03 17:16:05
UTC ·
(1 week ago)
Bad behaviour
Web Spam
🇩🇪
joetaylor.dev
2026-11-03 15:53:45
UTC ·
(1 week ago)
[Stream Repeater WAF] Path Traversal / Local File Inclusion (LFI) on Port 443 (HTTPS)
Activity: 5 repeated security violations observed.
Target: GET /mail/phpinfo.php
Trigger: ModSecurity OWASP CRS 930130 - Restricted File Access Attempt
Evidence: Ma ...
show more
[Stream Repeater WAF] Path Traversal / Local File Inclusion (LFI) on Port 443 (HTTPS)
Activity: 5 repeated security violations observed.
Target: GET /mail/phpinfo.php
Trigger: ModSecurity OWASP CRS 930130 - Restricted File Access Attempt
Evidence: Matched Data: phpinfo.php found within REQUEST_FILENAME: /mail/phpinfo.php
Event Time: 2026-11-03 15:53:45 UTC
Mitigation: Blocked at edge & IP challenged by Security Policy.
show less
Web App Attack
Hacking
🇵🇫
www.gregorymariani.com
2026-11-03 13:50:49
UTC ·
(1 week ago)
Web App Attack
Anonymous
2026-11-02 16:34:12
UTC ·
(1 week ago)
3.138.142.23 - - [02/Nov/2026:16:34:10 +0000] "GET /mailer/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
3.138.142.23 - - [02/Nov/2026:16:34:10 +0000] "GET /mail ...
show more
3.138.142.23 - - [02/Nov/2026:16:34:10 +0000] "GET /mailer/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
3.138.142.23 - - [02/Nov/2026:16:34:10 +0000] "GET /mail/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
...
show less
Port Scan
Hacking
Bad Web Bot
🇫🇷
dynamix
2026-11-02 12:16:06
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇷
Campus France
2026-11-02 12:15:55
UTC ·
(1 week ago)
[Mon Nov 02 13:15:53.308481 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/phpinfo.php' not found or unable to stat
[Mon Nov 02 13:15:53.818206 2026] [php:error] [pid 1426532] [client 3.138.142.23:5 ...
show more
[Mon Nov 02 13:15:53.308481 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/phpinfo.php' not found or unable to stat
[Mon Nov 02 13:15:53.818206 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/info.php' not found or unable to stat
[Mon Nov 02 13:15:54.151194 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/php.php' not found or unable to stat
[Mon Nov 02 13:15:54.539540 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/i.php' not found or unable to stat
[Mon Nov 02 13:15:54.893225 2026] [php:error] [pid 1426532] [client 3.138.142.23:52184] script '/var/www/html/brume.org/radios/pi.php' not found or unable to stat
...
show less
Brute-Force
Web App Attack
🇨🇭
Origon
2026-11-02 08:23:28
UTC ·
(1 week ago)
plesk-modsecurity - IP: 3.138.142.23 - [02/Nov/2026:09:23:27.768292 +0100] auhIfyX62zK7a9eNmcHDLQAAAIw 3.138.142.23 60172 127.0.0.1 7081 [02/Nov/2026:09:23:28.001116 +0100] auhIgHaV5AgP9BySiqi5AwAAANM 3.138.142.23 60190 127.0.0.1 7081 [02/Nov/2026:0 ...
show more
plesk-modsecurity - IP: 3.138.142.23 - [02/Nov/2026:09:23:27.768292 +0100] auhIfyX62zK7a9eNmcHDLQAAAIw 3.138.142.23 60172 127.0.0.1 7081 [02/Nov/2026:09:23:28.001116 +0100] auhIgHaV5AgP9BySiqi5AwAAANM 3.138.142.23 60190 127.0.0.1 7081 [02/Nov/2026:09:23:28.117848 +0100] auhIgHaV5AgP9BySiqi5BAAAAMc 3.138.142.23 60204 127.0.0.1 7081 [02/Nov/2026:09:23:28.232893 +0100] auhIgHaV5AgP9BySiqi5BQAAAMk 3.138.142.23 60228 127.0.0.1 7081
show less
Web App Attack
🇳🇱
e.fierstra
2026-11-02 07:18:58
UTC ·
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
mail.avx.gr
2026-11-02 07:02:44
UTC ·
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted] 3.138.142.23 (US/United States/Ohio/Dublin/ec2-3-138-142-23.us-east-2.compute.amazonaws.com): (CF_ENABLE)
SQL Injection
🇫🇷
Catalin Negru
2026-11-02 06:29:01
UTC ·
(1 week ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇮🇹
VHosting
2026-11-02 04:15:04
UTC ·
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack