🇳🇱
homeshowdomain.nl
2026-06-16 22:03:56
(21 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-15.
show less
Web App Attack
SSH
Hacking
🇧🇾
lns.bz
2026-06-15 12:09:07
(2 days ago)
.env scanning [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 07:30:46
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 03:30:41.757688 2026] [security2:error] [pid 5052:tid 5052] [client 35.202.233.158:41878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jennlaurenphotography.com"] [uri "/.env"] [unique_id "ai-qIdb1OOMlC5JtZObxTAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 06:58:40
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 02:58:35.297356 2026] [security2:error] [pid 23534:tid 23534] [client 35.202.233.158:39588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.san-marino-boat-registration.com.boatregistrationdelaware.com"] [uri "/.env"] [unique_id "ai-im55cb0LkoOG8AL4IVgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-15 05:08:15
(2 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2026-06-15 05:02:31
(2 days ago)
. Matched phrase "/.env" at REQUEST_URI. (210492-169)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 00:39:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 20:39:02.380210 2026] [security2:error] [pid 5353:tid 5353] [client 35.202.233.158:58184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scottcarper.com"] [uri "/.env.template"] [unique_id "ai9JpvX6cdgBaCczRiufyQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 22:46:57
(2 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 21:00:38
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.202.233.158 (158.233.202.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 17:00:33.783373 2026] [security2:error] [pid 8297:tid 8297] [client 35.202.233.158:38470] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.franknash.nashes.net"] [uri "/.env.local"] [unique_id "ai8WcbtHmbLZwPOW99_w8gAAAF8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇰
i553041
2026-06-14 19:49:25
(2 days ago)
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env.qa HTTP/1.1" 401 0 "-" "Mozilla/5.0 (iPad ...
show more
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env.qa HTTP/1.1" 401 0 "-" "Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25" "-"
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env~ HTTP/1.1" 401 0 "-" "Mozilla/5.0 (Linux; Android 8.0.0; G8441) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 YaBrowser/19.1.3.198.00 Mobile Safari/537.36" "-"
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env.testing HTTP/1.1" 401 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0) Asus;Galaxy6" "-"
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env.test HTTP/1.1" 401 0 "-" "Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36" "-"
35.202.233.158 - - [15/Jun/2026:03:49:24 +0800] "GET /.env.dist HTTP/1.1" 401 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100
...
show less
Brute-Force
SSH
🇨🇭
leo1305
2026-06-14 12:23:30
(3 days ago)
CrowdSec detection | scenario: http-probing
Port Scan
Web App Attack
🇮🇹
VHosting
2026-06-14 02:45:03
(3 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇧🇷
mrcrassi
2026-06-13 19:45:02
(3 days ago)
Automated PortScan detection via Mikrotik - 2026-06-13T16:45:02-03:00
Port Scan