🇫🇷
phoenix1jl96
2026-11-14 06:21:58
UTC ·
(5 hours ago)
2026/11/14 07:21:54 [error] 2093845#2093845: *620568 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.158.42.158, server: box.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "box.ledemon.us"
2 ...
show more
2026/11/14 07:21:54 [error] 2093845#2093845: *620568 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.158.42.158, server: box.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "box.ledemon.us"
2026/11/14 07:21:55 [error] 2093845#2093845: *620568 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.158.42.158, server: box.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "box.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇬🇧
jackalek
2026-11-14 06:19:08
UTC ·
(5 hours ago)
34.158.42.158 - - [14/Nov/2026:06:19:06 +0000] "GET /.git/config HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:06:19:06 +0000] "G ...
show more
34.158.42.158 - - [14/Nov/2026:06:19:06 +0000] "GET /.git/config HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:06:19:06 +0000] "GET /.env HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:06:19:06 +0000] "GET /.env.local HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:06:19:07 +0000] "GET /.env.production HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:06:19:07 +0000] "GET /.env.staging HTTP/1.1" 404 553 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
...
show less
Brute-Force
Web App Attack
🇧🇬
Ilcheff
2026-11-14 05:19:40
UTC ·
(6 hours ago)
Web scan (probing for sensitive files, CrowdSec http-sensitive-files): requests from 158.42.158.34.bc.googleusercontent.com [SG, AS396982 Google LLC] to a web server.
Web App Attack
🇸🇪
vaia.cloud
2026-11-14 04:10:01
UTC ·
(7 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
Anonymous
2026-11-14 03:04:39
UTC ·
(8 hours ago)
Blocked by ModSec and CSF
Port Scan
🇮🇹
CoreTech srl
2026-11-14 02:23:59
UTC ·
(9 hours ago)
cloudlinux2 fail2ban: 2026-11-14 03:19:36,230 fail2ban.filter [1443]: INFO [plesk-wordpress] Found 77.227.2.78 - 2026-11-14 03:19:34cloudlinux2 fail2ban: 2026-11-14 03:20:20,159 fail2ban.actions [1443]: NOTICE [plesk-modsecurity] U ...
show more
cloudlinux2 fail2ban: 2026-11-14 03:19:36,230 fail2ban.filter [1443]: INFO [plesk-wordpress] Found 77.227.2.78 - 2026-11-14 03:19:34cloudlinux2 fail2ban: 2026-11-14 03:20:20,159 fail2ban.actions [1443]: NOTICE [plesk-modsecurity] Unban 34.153.161.31cloudlinux2 fail2ban: 2026-11-14 03:20:56,354 fail2ban.filter [1443]: INFO [plesk-wordpress] Found 146.120.251.198 - 2026-11-14 03:20:55cloudlinux2 fail2ban: 2026-11-14 03:21:18,802 fail2ban.filter [1443]: INFO [plesk-wordpress] Found 103.251.59.200 - 2026-11-14 03:21:18cloudlinux2 fail2ban: 2026-11-14 03:21:28,133 fail2ban.filter [1443]: INFO [plesk-wordpress] Found 106.222.227.31 - 2026-11-14 03:21:26cloudlinux2 fail2ban: 2026-11-14 03:22:38,755 fail2ban.filter [1443]: INFO [plesk-modsecurity] Found 34.158.42.158 - 2026-11-14 03:22:38cloudlinux2 fail2ban: 2026-11-14 03:22:39,548 fail2ban.filter [1443]: INFO [recidive] Found 34.158.42.158 - 2026-11-14 03:22:39cloudlinux2 fail2ban: 2026-11-14
show less
Web App Attack
🇸🇪
FrontQ
2026-11-14 02:12:58
UTC ·
(9 hours ago)
Blocked and banned by CrowdSec on our servers: crowdsecurity/vpatch-env-access
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-14 02:00:36
UTC ·
(9 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
francelink.fr
2026-11-14 01:37:23
UTC ·
(9 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-14T01:36:15.000Z.
Web App Attack
Anonymous
2026-11-14 01:15:36
UTC ·
(10 hours ago)
34.158.42.158 - - [14/Nov/2026:02:15:18 +0100] "GET /.git/config HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:02:15:18 +0100] "G ...
show more
34.158.42.158 - - [14/Nov/2026:02:15:18 +0100] "GET /.git/config HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:02:15:18 +0100] "GET /.env HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:02:15:19 +0100] "GET /.env.local HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:02:15:19 +0100] "GET /.env.production HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.158.42.158 - - [14/Nov/2026:02:15:19 +0100] "GET /.env.staging HTTP/1.1" 403 614 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
...
show less
DDoS Attack
🇳🇱
e.fierstra
2026-11-14 00:57:30
UTC ·
(10 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-11-14 00:56:00
UTC ·
(10 hours ago)
2026-11-14 01:54:14 GET /.git/config [301] && 2026-11-14 01:54:15 GET /.env [301] && 2026-11-14 01:54:16 GET /.env.bak [301] && 230 more within 20 minutes
Web App Attack
🇩🇪
big-cloud.nl
2026-11-14 00:51:23
UTC ·
(10 hours ago)
Try to access /.git/config
Web App Attack
Anonymous
2026-11-14 00:49:19
UTC ·
(10 hours ago)
Bot / seems abusive / Apache connections: 46
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-13 23:37:09
UTC ·
(11 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack