Anonymous
2026-07-29 07:00:00
UTC ·
(3 months ago)
Apache probe; attempts=1638; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /. ...
show more
Apache probe; attempts=1638; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /.env.preprod | /.env.prod | /.env.production | /.env.remote | /.env.sample | /.env.save | /.env.stage | /.env.staging | /.env.swp | /.env.test | /.env.txt | /.env.uat | /.env.yaml | /.env.yml | /.env~ | /.git/.env | /.git/config | /actions/.env | /admin-panel/.env | /admin/.env | /administrator/.env | /angular/.env | /ansible/.env | /api/.env | /api/dev/.env | /api/staging/.env | /api/v1/.env | /api/v2/.env | /api/v3/.env | /app/.env | /application/.env | /apps/.env | /assets/.env | /aws/.env | /azure/.env | /backend/.env | /backup/.env | /backups/.env | /beta/.env | /bin/.env | /bootstrap/.env | /brevo/.env | /build/.env | /buildkite/.env | /bulk/.env | /cache/.en | ... [204 exact paths total]
show less
Web App Attack
🇮🇳
evicky2002
2026-07-28 06:00:00
UTC ·
(3 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
Site.eu
2026-07-27 13:18:33
UTC ·
(3 months ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-07-27 12:36:56
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 08:36:51.073402 2026] [security2:error] [pid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 08:36:51.073402 2026] [security2:error] [pid 30510:tid 30510] [client 3.145.167.51:52670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.trimandtend.com.abbeygardensllandudno.com"] [uri "/.git/config"] [unique_id "amdQ438fub7oZ9YpZaW8TAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-07-27 12:29:29
UTC ·
(3 months ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇸🇪
vaia.cloud
2026-07-27 12:20:01
UTC ·
(3 months ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇬🇧
Oakley
2026-07-27 10:53:04
UTC ·
(3 months ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇺🇸
TPI-Abuse
2026-07-27 10:51:39
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 06:51:33.175232 2026] [security2:error] [pid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 06:51:33.175232 2026] [security2:error] [pid 1799434:tid 1799545] [client 3.145.167.51:34018] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.trident-environmental.com"] [uri "/.git/config"] [unique_id "amc4NYDc_A6VIknrMcKCegAAANE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-07-27 09:39:33
UTC ·
(3 months ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇫🇷
dynamix
2026-07-27 09:39:09
UTC ·
(3 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 09:04:50
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 05:04:43.235838 2026] [security2:error] [pid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 05:04:43.235838 2026] [security2:error] [pid 3162349:tid 3162349] [client 3.145.167.51:46780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tribalmystic.okwellbeing.com"] [uri "/.git/config"] [unique_id "amcfK1JSgykl-YsXzE0H7wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-07-27 08:54:55
UTC ·
(3 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇮🇩
Burayot
2026-07-27 08:11:24
UTC ·
(3 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 3.145.167.51 (US/United States/ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 3600 secs
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 07:12:49
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:12:42.704761 2026] [security2:error] [pid 4 ...
show more
(mod_security) mod_security (id:210492) triggered by 3.145.167.51 (ec2-3-145-167-51.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:12:42.704761 2026] [security2:error] [pid 4171875:tid 4171875] [client 3.145.167.51:51276] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.trhs70.rwcartoons.com"] [uri "/.git/config"] [unique_id "amcE6uhP5WNpBryAQl1MvQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-07-27 05:37:32
UTC ·
(3 months ago)
CrowdSec: crowdsecurity/http-sensitive-files | req: /.git/config | 5 distinct paths | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking