🇩🇪
ger-stg-sifi1
2026-06-11 05:37:40
(57 minutes ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
webanyone
2026-06-11 04:30:27
(2 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
2026-06-11 04:12:11
(2 hours ago)
(caddyscan) Scanner path probe from 34.176.2.107 (CL/Chile/107.2.176.34.bc.googleusercontent.com): 5 ...
show more
(caddyscan) Scanner path probe from 34.176.2.107 (CL/Chile/107.2.176.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.176.2.107 - - [11/Jun/2026:04:12:05 +0000] "GET /api/.env.prod HTTP/1.1"
[REDACTED] 200 2627 34.176.2.107 - - [11/Jun/2026:04:12:05 +0000] "GET /.env.local.bak HTTP/1.1"
[REDACTED] 200 2627 34.176.2.107 - - [11/Jun/2026:04:12:05 +0000] "GET /stage/.env HTTP/1.1"
[REDACTED] 200 2627 34.176.2.107 - - [11/Jun/2026:04:12:05 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 34.176.2.107 - - [11/Jun/2026:04:12:05 +0000] "GET /api/.env.backup HTTP/1.1"
show less
Port Scan
🇳🇱
homeshowdomain.nl
2026-06-10 22:01:49
(8 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-09.
show less
Web App Attack
SSH
Hacking
🇳🇱
wlt-blocker
2026-06-10 20:17:37
(10 hours ago)
Unauthorized access to webpage admin
Web App Attack
2026-06-10 18:31:11
(12 hours ago)
Bot / seems abusive / Apache connections: 48
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇩🇪
paissangroup
2026-06-10 17:56:10
(12 hours ago)
Multiple WAF Violations
Web App Attack
2026-06-10 08:10:30
(22 hours ago)
Aggressive web scan
Web App Attack
🇬🇧
openstrike.co.uk
2026-06-10 05:14:17
(1 day ago)
146 attacks on env grabbing URLs:
GET /services/auth/.env HTTP/1.1
Hacking
🇳🇱
e.fierstra
2026-06-10 05:07:08
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-10 01:23:17
(1 day ago)
[WedJun1003:23:12.9500202026][security2:error][pid3789234:tid3789385][client34.176.2.107:0]ModSecuri ...
show more
[WedJun1003:23:12.9500202026][security2:error][pid3789234:tid3789385][client34.176.2.107:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"autoeuro.lv\"][uri\"/api/v2/.env\"][unique_id\"aii8gIWlwCOTYgz7hqaFWAAAARY\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-06-10 00:05:28
(1 day ago)
{"level":"info","ts":1781049926.555195,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1781049926.555195,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.176.2.107","remote_port":"54920","client_ip":"34.176.2.107","proto":"HTTP/1.1","method":"GET","host":"rqponmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.production","headers":{"User-Agent":["Mozilla/5.0 (Android 4.2; rv:19.0) Gecko/20121129 Firefox/19.0"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000080414,"size":0,"status":308,"resp_headers":{"Location":["https://rqponmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.env.production"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"level":"info","ts":1781049926.5577857,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.176.2.107","remote_port":"54914","client_ip":"34.176.2.107","proto":"HTTP/1.1","method":"GET","host":"rqponmlkjihgc
...
show less
DDoS Attack
Web App Attack
🇳🇱
Site.eu
2026-06-09 21:17:21
(1 day ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
zwebvigil
2026-06-09 15:15:56
(1 day ago)
34.176.2.107 [09/Jun/2026:08:15:56 -0700] "GET /.env.stage HTTP/1.1" 404 2685 "-" port=34768 "Mozil ...
show more
34.176.2.107 [09/Jun/2026:08:15:56 -0700] "GET /.env.stage HTTP/1.1" 404 2685 "-" port=34768 "Mozilla/5.0 (X11; CentOS; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0" "-" "-" "www.<host>" 1576
34.176.2.107 [09/Jun/2026:08:15:56 -0700] "GET /.env.copy HTTP/1.1" 404 2683 "-" port=34776 "Mozilla/5.0 (Windows NT 10.0; ARM; Lumia 950 Dual SIM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393" "-" "-" "www.<host>" 1686
34.176.2.107 [09/Jun/2026:08:15:56 -0700] "GET /.env.qa HTTP/1.1" 404 2679 "-" port=34790 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3879.0 Safari/537.36 Edg/78.0.249.1" "-" "-" "www.<host>" 803
34.176.2.107 [09/Jun/2026:08:15:56 -0700] "GET /.env HTTP/1.1" 404 2673 "-" port=34804 "Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+" "-" "-" "www.<host>" 583
34.176.2
show less
Web App Attack
2026-06-09 15:12:22
(1 day ago)
34.176.2.107 - - [09/Jun/2026:17:12:20 +0200] "GET /.env.orig HTTP/1.1" 403 12583 "-" "Mozilla/4.0 ( ...
show more
34.176.2.107 - - [09/Jun/2026:17:12:20 +0200] "GET /.env.orig HTTP/1.1" 403 12583 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Maxthon 2.0)"
34.176.2.107 - - [09/Jun/2026:17:12:21 +0200] "GET /.env~ HTTP/1.1" 403 12583 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
34.176.2.107 - - [09/Jun/2026:17:12:21 +0200] "GET /.env.development.local HTTP/1.1" 403 12583 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.119"
34.176.2.107 - - [09/Jun/2026:17:12:21 +0200] "GET /env HTTP/1.1" 403 12583 "-" "Mozilla/5.0 (WindowsCE 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
34.176.2.107 - - [09/Jun/2026:17:12:21 +0200] "GET /.env.local.bak HTTP/1.1" 403 12583 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, li
...
show less
Bad Web Bot
Web App Attack