🇳🇱
Site.eu
2026-10-17 17:51:35
(19 minutes ago)
Excessive 404/403 errors
Brute-Force
🇩🇪
jbcrn
2026-10-17 17:05:36
(1 hour ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇨🇦
internetworld
2026-10-17 16:43:03
(1 hour ago)
34.56.117.205 - - [17/Oct/2026:16:43:02 +0000] "GET /.env.aws HTTP/2.0" 200 314 "-" "Mozilla/5.0 (Wi ...
show more
34.56.117.205 - - [17/Oct/2026:16:43:02 +0000] "GET /.env.aws HTTP/2.0" 200 314 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇬🇧
MrTumnus
2026-10-17 16:41:02
(1 hour ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
2026-10-17 13:45:18
(4 hours ago)
Observed scanned 33 known-sensitive endpoint(s), e.g.: /.aws/.env, /.docker/.env, /.docker/laravel/a ...
show more
Observed scanned 33 known-sensitive endpoint(s), e.g.: /.aws/.env, /.docker/.env, /.docker/laravel/app/.env, /.env.old, /.env.php, /.env.swp
show less
Bad Web Bot
Web App Attack
🇪🇨
CYBER-SECURITY-MM
2026-10-17 11:45:30
(6 hours ago)
Detected and banned by CrowdSec. Scenario: crowdsecurity/http-sensitive-files. HTTP 404. Path: /.aws ...
show more
Detected and banned by CrowdSec. Scenario: crowdsecurity/http-sensitive-files. HTTP 404. Path: /.aws/config. Evidence: 1 matching alerts.
show less
Web App Attack
2026-10-17 11:34:16
(6 hours ago)
"GET /.aws/.env HTTP/1.1"
Hacking
Web App Attack
🇩🇪
todix
2026-10-17 05:30:03
(12 hours ago)
"GET /.aws/config HTTP/2.0" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ...
show more
"GET /.aws/config HTTP/2.0" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 05:24:59
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.56.117.205 (205.117.56.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.56.117.205 (205.117.56.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 01:24:53.253535 2026] [security2:error] [pid 18795:tid 18795] [client 34.56.117.205:60780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lorlandinc.indie100.com"] [uri "/.aws/.env"] [unique_id "atMGpdq6tjIryj_-qP1TqQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-17 05:24:09
(12 hours ago)
[Sat Oct 17 07:24:07.695826 2026] [access_compat:error] [pid 468202:tid 468202] [client 34.56.117.20 ...
show more
[Sat Oct 17 07:24:07.695826 2026] [access_compat:error] [pid 468202:tid 468202] [client 34.56.117.205:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.boto
[Sat Oct 17 07:24:07.737094 2026] [access_compat:error] [pid 469261:tid 469261] [client 34.56.117.205:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.aws
[Sat Oct 17 07:24:07.776992 2026] [access_compat:error] [pid 469259:tid 469259] [client 34.56.117.205:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.amplifyrc
[Sat Oct 17 07:24:07.777035 2026] [access_compat:error] [pid 470237:tid 470237] [client 34.56.117.205:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.claude
[Sat Oct 17 07:24:07.778257 2026] [access_compat:error] [pid 470235:tid 470235] [client 34.56.117.205:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.docker
...
show less
Web Spam
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-17 05:16:27
(12 hours ago)
3 attacks on password/key grabbing URLs:
GET /.git-credentials HTTP/1.1
Hacking
🇬🇧
Aetherweb Ark
2026-10-17 05:14:32
(12 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.56.117.205 (US/United States/205.117.56.34.b ...
show more
(mod_security) mod_security (id:949110) triggered by 34.56.117.205 (US/United States/205.117.56.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇨🇳
SA19999
2026-10-17 05:13:56
(12 hours ago)
Auto-report: abuseipdb:confirmed:ps:modsec:10001 | sources=["peer-sync"] | Fox honeypot cluster
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 05:09:35
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.56.117.205 (205.117.56.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.56.117.205 (205.117.56.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 01:09:31.064176 2026] [security2:error] [pid 23929:tid 23929] [client 34.56.117.205:36084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lonasytoldosdelatorre.com.disenowebprofesional.com"] [uri "/.aws/.env"] [unique_id "atMDC4q7Z_Tap4mhZFek5gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇸
pexodelic
2026-10-17 05:05:02
(13 hours ago)
Automated report from web, SSH and FTP server logs: 74 requests probing for exposed secrets (.env, . ...
show more
Automated report from web, SSH and FTP server logs: 74 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-16 23:05 UTC, last reported 2026-10-17 07:05 UTC; counts cover the current log rotation window.
show less
Hacking
Web App Attack