🇬🇧
andypiper
2026-09-15 01:00:52
UTC ·
(1 month ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-09-15 00:15:23
UTC ·
(1 month ago)
[Mon Sep 14 18:15:14.594568 2026] [authz_core:error] [pid 2247:tid 140603841033792] [client 34.150.49.22:56526] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Mon Sep 14 18:15:22.454230 2026] [authz_core:error] [pid 2247:tid ...
show more
[Mon Sep 14 18:15:14.594568 2026] [authz_core:error] [pid 2247:tid 140603841033792] [client 34.150.49.22:56526] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Mon Sep 14 18:15:22.454230 2026] [authz_core:error] [pid 2247:tid 140603639674432] [client 34.150.49.22:56526] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Mon Sep 14 18:15:22.648984 2026] [authz_core:error] [pid 2247:tid 140603673245248] [client 34.150.49.22:56526] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot
🇷🇴
clauss
2026-09-14 23:22:05
UTC ·
(1 month ago)
34.150.49.22 - - [15/Sep/2026:02:22:04 +0300] "GET /.git/config HTTP/1.1" 200 314 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.150.49.22 - - [15/Sep/2026:02:22:05 +0300] "GET ...
show more
34.150.49.22 - - [15/Sep/2026:02:22:04 +0300] "GET /.git/config HTTP/1.1" 200 314 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.150.49.22 - - [15/Sep/2026:02:22:05 +0300] "GET /.env.local HTTP/1.1" 200 314 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇵🇱
strefapi_com
2026-09-14 18:51:55
UTC ·
(1 month ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇦🇺
rubixstudios
2026-09-14 16:54:02
UTC ·
(1 month ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇫🇷
phoenix1jl96
2026-09-14 16:22:22
UTC ·
(1 month ago)
2026/09/14 18:22:21 [error] 4744#4744: *158629 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.150.49.22, server: autoconfig.goelug.org, request: "GET /mailer/.env HTTP/1.1", host: "autoconfig.goelug ...
show more
2026/09/14 18:22:21 [error] 4744#4744: *158629 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.150.49.22, server: autoconfig.goelug.org, request: "GET /mailer/.env HTTP/1.1", host: "autoconfig.goelug.org"
2026/09/14 18:22:21 [error] 4744#4744: *158629 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.150.49.22, server: autoconfig.goelug.org, request: "GET /mail/.env HTTP/1.1", host: "autoconfig.goelug.org"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇩🇪
4server
2026-09-14 15:57:40
UTC ·
(1 month ago)
[MonSep1417:57:37.4155292026][security2:error][pid2017800:tid2017874][client34.150.49.22:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BL ...
show more
[MonSep1417:57:37.4155292026][security2:error][pid2017800:tid2017874][client34.150.49.22:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"autoconfig.gmint.ch\"][uri\"/.git/config\"][unique_id\"aqgZcWPFuKjr4jcOaw4p2wAAAI0\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-09-13 15:41:44
UTC ·
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
interbiznw.com
2026-09-13 15:03:47
UTC ·
(1 month ago)
fail2ban-ban
Hacking
Brute-Force
Exploited Host
Web App Attack
2026-09-13 01:14:13
UTC ·
(2 months ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-12 18:34:05
UTC ·
(2 months ago)
853 requests with url.path *.env
140 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇨🇦
polycoda
2026-09-12 09:58:00
UTC ·
(2 months ago)
🔥 VERY AGGRESSIVE SCANNER probed over 200 inexistent files and PHP scripts in less than an hour.
Hacking
Web App Attack
2026-09-12 08:58:02
UTC ·
(2 months ago)
Bot / scanning and/or hacking attempts: GET /.env.uat HTTP/1.1, POST / HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.preprod HTTP/1.1, GET /.env.test HTTP/1.1, GET /.env.swp HTTP/1.1, GET /apps/.env HTTP/1.1, GET /api/.env HTTP/1.1, GET /site/.env HTT ...
show more
Bot / scanning and/or hacking attempts: GET /.env.uat HTTP/1.1, POST / HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.preprod HTTP/1.1, GET /.env.test HTTP/1.1, GET /.env.swp HTTP/1.1, GET /apps/.env HTTP/1.1, GET /api/.env HTTP/1.1, GET /site/.env HTTP/1.1, GET /web/.env HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /public/.env HTTP/1.1
show less
Hacking
Web App Attack
🇿🇦
conure.sh
2026-09-12 08:55:06
UTC ·
(2 months ago)
csagent: score 21.4: 404 noise floor x6, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 06:49:49
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 34.150.49.22 (22.49.150.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 02:49:44.865692 2026] [security2:error] [pid 11474:tid 11 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.150.49.22 (22.49.150.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 02:49:44.865692 2026] [security2:error] [pid 11474:tid 11474] [client 34.150.49.22:57332] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "admin.cmabiblequizzing.org"] [uri "/.git/config"] [unique_id "aqT2CAr5Tw0qZydiyA236wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
