🇫🇷
security.rdmc.fr
2026-11-15 20:40:42
UTC ·
(34 minutes ago)
Activity from blacklisted IP
Hacking
🇬🇧
consul.to
2026-11-15 20:02:15
UTC ·
(1 hour ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 19:21:52
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 38.102.86.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:21:48.706626 2026] [security2:error] [pid 15106:tid 15106] [client 38.102.86.167:59542] M ...
show more
(mod_security) mod_security (id:210492) triggered by 38.102.86.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:21:48.706626 2026] [security2:error] [pid 15106:tid 15106] [client 38.102.86.167:59542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "meshbagsandmore.com"] [uri "/.env.txt"] [unique_id "avoGTDcS0_jk40DiPPNxCQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-15 19:09:01
UTC ·
(2 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: ldap.teddypot.tech | Path: /pathscan-201982a92e5c-nope.env | User-Agent: Mozilla/5.0 (Windows ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: ldap.teddypot.tech | Path: /pathscan-201982a92e5c-nope.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-15 18:04:59
UTC ·
(3 hours ago)
Bloqueado automaticamente por CrowdSec escenario crowdsecurity/http-sensitive-files
Brute-Force
2026-11-15 17:02:56
UTC ·
(4 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/appsec-vpatch; Action=ban; Events=2; Country=CA; ASN=26832 RICAWEBSERVICES
Hacking
🇧🇷
radardatelecom
2026-11-15 16:57:03
UTC ·
(4 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-15 16:55:27
UTC ·
(4 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cdn.goblinpot.site | Path: /pathscan-5df4e7655c31-nope.env | User-Agent: Mozilla/5.0 (Windows ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cdn.goblinpot.site | Path: /pathscan-5df4e7655c31-nope.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
HandyTreff.de
2026-11-15 16:48:47
UTC ·
(4 hours ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -59.606 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Sa
Web App Attack
Bad Web Bot
🇨🇭
zynex
2026-11-15 16:02:25
UTC ·
(5 hours ago)
URL Probing: /index.php
Web App Attack
🇳🇱
Alt255
2026-11-15 15:13:50
UTC ·
(6 hours ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 38.102.86.167 - - [15/Nov/2026:16:13:29 +0100] "GET /.env.txt HTTP/1.1" 301 349 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 38.102.86.167 - - [15/Nov/2026:16:13:29 +0100] "GET /.env.txt HTTP/1.1" 301 349 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 14:54:25
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 38.102.86.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 09:54:20.201238 2026] [security2:error] [pid 28122:tid 28142] [client 38.102.86.167:57376] M ...
show more
(mod_security) mod_security (id:210492) triggered by 38.102.86.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 09:54:20.201238 2026] [security2:error] [pid 28122:tid 28142] [client 38.102.86.167:57376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web201.dnchosting.com"] [uri "/.env.production"] [unique_id "avnHnLpsDlzwSHqnaC-ptwAAAJI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-15 14:50:37
UTC ·
(6 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
2026-11-15 14:43:18
UTC ·
(6 hours ago)
http scanning for .env files
...
Hacking
Web App Attack
🇬🇧
sc user
2026-11-15 12:52:52
UTC ·
(8 hours ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
