🇳🇱
homeshowdomain.nl
2026-09-23 22:03:50
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-22.
show less
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-09-23 12:13:49
(1 day ago)
csagent: score 20.8: 404 noise floor x3, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0 ...
show more
csagent: score 20.8: 404 noise floor x3, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0s
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-22 22:00:38
(2 days ago)
Auto-ban: >3000 req/min op 2026-09-22
Web App Attack
SSH
Hacking
🇩🇪
tentwentyfour
2026-09-22 16:20:18
(2 days ago)
Blocked for probing for sensitive web application components
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-09-22 15:57:59
(2 days ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Alt255
2026-09-22 15:52:50
(2 days ago)
[ti-14al] Web exploit scanning: 3 suspicious requests detected by fail2ban jail <name>. Example: 35. ...
show more
[ti-14al] Web exploit scanning: 3 suspicious requests detected by fail2ban jail <name>. Example: 35.200.223.91 - - \[22/Sep/2026:17:52:36 +0200\] "GET /.env.prod HTTP/1.1" 403 5805 "-" "crusader-worker/1.0"
35.200.223.91 - - \[22/Sep/2026:17:52:36 +0200\] "GET /.env.example HTTP/1.1" 403 5805 "-" "crusader-worker/1.0"
35.200.223.91 - - \[22/Sep/2026:17:52:36 +0200\] "GET /.env.bak HTTP/1.1" 403 5805 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇫🇮
paissangroup
2026-09-22 15:42:08
(2 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:39:13
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.200.223.91 (91.223.200.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.200.223.91 (91.223.200.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:39:08.141930 2026] [security2:error] [pid 7558:tid 7571] [client 35.200.223.91:53070] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "notedstories.com"] [uri "/.env.dev"] [unique_id "arKhHN66OzdwKzgQF8plrAAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:18:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.200.223.91 (91.223.200.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.200.223.91 (91.223.200.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:17:59.739440 2026] [security2:error] [pid 20088:tid 20088] [client 35.200.223.91:39640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "modestosoftwater.com"] [uri "/.env.example"] [unique_id "arKcJyz5ZfX-xKhID66W-gAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-22 15:12:26
(2 days ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.200.223.91 - - [22/Sep/2026:17:12:04 +0200] "GET /.env.old HTTP/1.1" 301 445 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
2026-09-22 14:58:07
(2 days ago)
[news.tmg.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.env.dev | /.env.local | / ...
show more
[news.tmg.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.env.dev | /.env.local | /.env.old
show less
Hacking
Web App Attack
🇳🇱
tmiland
2026-09-22 14:57:18
(2 days ago)
(nginx_404) Dot directory Honeypot Trap 35.200.223.91 (IN/India/91.223.200.35.bc.googleusercontent.c ...
show more
(nginx_404) Dot directory Honeypot Trap 35.200.223.91 (IN/India/91.223.200.35.bc.googleusercontent.com): 2 in the last 3600 secs; IP: 35.200.223.91; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.200.223.91 - - [22/Sep/2026:16:57:09 +0200] "GET /.env.prod HTTP/1.1" 404 72395 "-" "crusader-worker/1.0" 35.200.223.91 - - [22/Sep/2026:16:57:12 +0200] "GET /.env HTTP/1.1" 404 0 "-" "crusader-worker/1.0"
show less
Brute-Force
🇺🇸
TAY
2026-09-22 14:51:10
(2 days ago)
35.200.223.91 - - [22/Sep/2026:22:47:18 +0800] "GET /wp-config.php.bak HTTP/1.1" 500 6220 "-" "crusa ...
show more
35.200.223.91 - - [22/Sep/2026:22:47:18 +0800] "GET /wp-config.php.bak HTTP/1.1" 500 6220 "-" "crusader-worker/1.0"
35.200.223.91 - - [22/Sep/2026:22:47:18 +0800] "GET /wp-config.php.swp HTTP/1.1" 500 6236 "-" "crusader-worker/1.0"
35.200.223.91 - - [22/Sep/2026:22:47:18 +0800] "GET /wp-config.php~ HTTP/1.1" 500 6236 "-" "crusader-worker/1.0"
35.200.223.91 - - [22/Sep/2026:22:51:09 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 475 "-" "crusader-worker/1.0"
35.200.223.91 - - [22/Sep/2026:22:51:09 +0800] "GET /wp-config.php.swp HTTP/1.1" 301 475 "-" "crusader-worker/1.0"
35.200.223.91 - - [22/Sep/2026:22:51:09 +0800] "GET /wp-config.php~ HTTP/1.1" 301 469 "-" "crusader-worker/1.0"
...
show less
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-09-22 14:45:07
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
SLSLLC
2026-09-22 14:27:08
(2 days ago)
35.200.223.91 - - [22/Sep/2026:14:27:06 +0000] "GET /.env.local HTTP/2.0" 403 1927 "-" "crusader-wor ...
show more
35.200.223.91 - - [22/Sep/2026:14:27:06 +0000] "GET /.env.local HTTP/2.0" 403 1927 "-" "crusader-worker/1.0"
...
show less
Brute-Force
Web App Attack
