🇨🇭
backslash
2026-05-23 05:24:01
(1 month ago)
Bad Web Bot
🇺🇸
MPL
2026-05-19 01:12:56
(2 months ago)
tcp port scan (1972 or more attempts)
Port Scan
🇫🇷
Timothee Lebourdais
2026-05-18 23:39:47
(2 months ago)
[nuc] Blocked by SysWarden Firewall (Web Attack)
Hacking
Web App Attack
Port Scan
🇩🇪
terminal.myselfhosted.online
2026-05-15 10:58:08
(2 months ago)
35.236.244.109 - - [15/May/2026:12:58:07 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Linu ...
show more
35.236.244.109 - - [15/May/2026:12:58:07 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (5S) Plus) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36"
35.236.244.109 - - [15/May/2026:12:58:07 +0200] "GET /.env.dev.local HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (compatible; Konqueror/4.1; DragonFly) KHTML/4.1.4 (like Gecko)"
35.236.244.109 - - [15/May/2026:12:58:07 +0200] "GET /.env.docker HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:48:29
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:48:23.956242 2026] [security2:error] [pid 15612:tid 15612] [client 35.236.244.109:54836] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gdcservices.com"] [uri "/.env.local"] [unique_id "agbBt38kQCFuAfCtfX_KeQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-05-15 03:05:29
(2 months ago)
Mutliple attempts to access forbidden web resources, HTTP code 403.
Web App Attack
🇮🇳
Genhost
2026-05-15 01:31:33
(2 months ago)
SCANNING OF PHP SHELL FILES
Brute-Force
SSH
🇺🇸
mnsf
2026-05-14 23:05:51
(2 months ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇫🇷
pm33
2026-05-14 18:57:12
(2 months ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 18:44:39
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 14:44:32.904001 2026] [security2:error] [pid 17863:tid 17863] [client 35.236.244.109:52550] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lesdaniels.com"] [uri "/admin/.env"] [unique_id "agYYEEODAlIPiFI1gC6jWgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
CBJ
2026-05-14 16:05:27
(2 months ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-12 21:59:20
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-11.
show less
Web App Attack
SSH
Hacking
2026-05-12 02:12:42
(2 months ago)
(PERMBLOCK) 35.236.244.109 (US/United States/109.244.236.35.bc.googleusercontent.com) has had more t ...
show more
(PERMBLOCK) 35.236.244.109 (US/United States/109.244.236.35.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-12 01:18:33
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.236.244.109 (109.244.236.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 21:18:28.516913 2026] [security2:error] [pid 28157:tid 28157] [client 35.236.244.109:39658] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3905ccn.us"] [uri "/.env.development.local"] [unique_id "agJ_5BIqaUdEqk5Fv1LieAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-05-12 00:48:30
(2 months ago)
Try to access /admin/.env
Web App Attack