🇸🇪
vaia.cloud
2026-11-14 20:40:01
UTC ·
(2 hours ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇩🇪
altenglaner
2026-11-14 19:51:26
UTC ·
(3 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇳🇱
e.fierstra
2026-11-14 19:36:48
UTC ·
(3 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
Anonymous
2026-11-14 18:07:18
UTC ·
(4 hours ago)
IP banned by Fail2Ban due to multiple malicious requests on Nginx
Brute-Force
SSH
Web App Attack
🇩🇪
raph
2026-11-14 17:36:40
UTC ·
(5 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇩🇪
mr.joecat
2026-11-14 17:25:27
UTC ·
(5 hours ago)
34.20.231.204 - - [14/Nov/2026:18:25:25 +0100] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.231.204 - - [14/Nov/2026:18:25:25 +0100] "G ...
show more
34.20.231.204 - - [14/Nov/2026:18:25:25 +0100] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.231.204 - - [14/Nov/2026:18:25:25 +0100] "GET /.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.231.204 - - [14/Nov/2026:18:25:25 +0100] "GET /.env.local HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.231.204 - - [14/Nov/2026:18:25:26 +0100] "GET /.env.production HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.20.231.204 - - [14/Nov/2026:18:25:26 +0100] "GET /.env.staging HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
...
show less
Web App Attack
🇧🇷
radardatelecom
2026-11-14 16:56:05
UTC ·
(5 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-11-14 16:29:23
UTC ·
(6 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-14T16:28:36.000Z.
Web App Attack
🇳🇱
Site.eu
2026-11-14 15:59:58
UTC ·
(6 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
Anonymous
2026-11-14 11:13:50
UTC ·
(11 hours ago)
34.20.231.204 - - [14/Nov/2026:05:13:47 -0600] "GET /.env.local HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.70.206.173
34.20.231.204 - - [14/Nov/2026:05:13:47 -06 ...
show more
34.20.231.204 - - [14/Nov/2026:05:13:47 -0600] "GET /.env.local HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.70.206.173
34.20.231.204 - - [14/Nov/2026:05:13:47 -0600] "GET /.env.production HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.70.206.173
34.20.231.204 - - [14/Nov/2026:05:13:48 -0600] "GET /.env.staging HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.70.206.173
34.20.231.204 - - [14/Nov/2026:05:13:48 -0600] "GET /.env.development HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.70.206.173
34.20.231.204 - - [14/Nov/2026:05:13:48 -0600] "GET /.env.test HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
vmd56152.contaboserver.net
2026-11-14 08:00:31
UTC ·
(14 hours ago)
[Sat Nov 14 09:00:19.170599 2026] [proxy_fcgi:error] [pid 2770614:tid 140028609029888] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:19.388037 2026] [proxy_fcgi:error] [pid 2770614:tid 140028592244480] [cl ...
show more
[Sat Nov 14 09:00:19.170599 2026] [proxy_fcgi:error] [pid 2770614:tid 140028609029888] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:19.388037 2026] [proxy_fcgi:error] [pid 2770614:tid 140028592244480] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:19.622266 2026] [proxy_fcgi:error] [pid 2770614:tid 140028038588160] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:19.830264 2026] [proxy_fcgi:error] [pid 2770614:tid 140028919396096] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:20.125168 2026] [proxy_fcgi:error] [pid 2770614:tid 140028927788800] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:20.834851 2026] [proxy_fcgi:error] [pid 2770614:tid 140028030195456] [client 34.20.231.204:60436] AH01071: Got error 'Primary script unknown'
[Sat Nov 14 09:00:21.091707 2026] [proxy
...
show less
Brute-Force
🇩🇪
FD-IX
2026-11-14 00:56:17
UTC ·
(21 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-13 23:01:29
UTC ·
(23 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-12.
Web App Attack
SSH
Hacking
🇩🇪
Mr-Money
2026-11-13 21:33:15
UTC ·
(1 day ago)
scenario: crowdsecurity/http-sensitive-files - events: 5
Web App Attack
Hacking
🇧🇪
cmbplf
2026-11-13 20:27:18
UTC ·
(1 day ago)
1.342 requests with url.path *.env
219 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot