🇩🇪
jotoma.de
2026-11-09 22:55:40
UTC ·
(3 days ago)
[Mon Nov 09 23:54:59.181136 2026] [authz_core:error] [pid 2001018:tid 2001118] [client 4.155.208.129:57735] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/secrets.yml, referer: https://144.76.87.140/
[Mon Nov 09 2 ...
show more
[Mon Nov 09 23:54:59.181136 2026] [authz_core:error] [pid 2001018:tid 2001118] [client 4.155.208.129:57735] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/secrets.yml, referer: https://144.76.87.140/
[Mon Nov 09 23:55:29.481162 2026] [authz_core:error] [pid 2001018:tid 2001116] [client 4.155.208.129:58381] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/filesystems.php , referer: https://144.76.87.140/
[Mon Nov 09 23:55:40.013942 2026] [authz_core:error] [pid 2001018:tid 2001107] [client 4.155.208.129:58381] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/services.php;, referer: https://144.76.87.140/
...
show less
Web Spam
Brute-Force
🇫🇮
KTSTechnology
2026-11-09 13:02:36
UTC ·
(3 days ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇺🇸
c y
2026-11-09 12:09:11
UTC ·
(3 days ago)
Security Monitor detected: sensitive_path_access
Port Scan
🇩🇪
Mr-Money
2026-11-09 08:12:28
UTC ·
(3 days ago)
scenario: crowdsecurity/http-probing - events: 11
Web App Attack
Hacking
Anonymous
2026-11-07 21:42:50
UTC ·
(5 days ago)
[email.tmg.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/actuator/configprops
Hacking
Web App Attack
🇺🇸
nasset
2026-11-07 18:53:52
UTC ·
(5 days ago)
4.155.208.129 - - [07/Nov/2026:10:53:16 -0800] "GET /Pulumi.yaml HTTP/1.1" 403 640 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [07/Nov/2026:10:53:16 -0800] "GET /.circleci/config.yml/ HTTP/1.1" 403 640 "https://38.46.23.243/ ...
show more
4.155.208.129 - - [07/Nov/2026:10:53:16 -0800] "GET /Pulumi.yaml HTTP/1.1" 403 640 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [07/Nov/2026:10:53:16 -0800] "GET /.circleci/config.yml/ HTTP/1.1" 403 640 "https://38.46.23.243/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.2 Safari/605.1.15"
4.155.208.129 - - [07/Nov/2026:10:53:29 -0800] "GET /debug/vars HTTP/1.1" 403 6333 "https://38.46.23.243/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
4.155.208.129 - - [07/Nov/2026:10:53:29 -0800] "GET /logs/error.log/ HTTP/1.1" 403 6333 "https://38.46.23.243/" "Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Mobile/15E148 Safari/604.1"
4.155.208.129 - - [07/Nov/2026:10:53:52 -0800] "GET /gcp-credentials.json HTTP/1.1" 403 6333 "-" "ExposureScanner/1.0 (internal-security-audit)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-07 08:51:54
UTC ·
(5 days ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇩🇪
sdos.es
2026-11-06 05:00:56
UTC ·
(6 days ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env.local.php"
Web App Attack
🇩🇪
Holger
2026-11-04 07:21:38
UTC ·
(1 week ago)
URL probing: GET /.env~
Web App Attack
🇩🇪
lolyay
2026-11-03 18:10:43
UTC ·
(1 week ago)
4.155.208.129 - - [03/Nov/2026:18:10:26 +0000] "GET /app/.env HTTP/1.1" 200 4 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:18:10:40 +0000] "GET /bootstrap/cache/config.php HTTP/1.1" 200 4 "-" "ExposureScanner/1.0 ...
show more
4.155.208.129 - - [03/Nov/2026:18:10:26 +0000] "GET /app/.env HTTP/1.1" 200 4 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:18:10:40 +0000] "GET /bootstrap/cache/config.php HTTP/1.1" 200 4 "-" "ExposureScanner/1.0 (internal-security-audit)"
...
show less
Web App Attack
Bad Web Bot
🇩🇪
SCHAPPY
2026-11-03 16:32:20
UTC ·
(1 week ago)
Faked HTTP referer string using numeric IP address of destination host instead of host name.
Hacking
Web App Attack
🇳🇱
spirttm
2026-11-03 13:26:36
UTC ·
(1 week ago)
4.155.208.129 - - [03/Nov/2026:13:26:18 +0000] "GET /parameters.yml HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:25 +0000] "GET /dump.sql HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (intern ...
show more
4.155.208.129 - - [03/Nov/2026:13:26:18 +0000] "GET /parameters.yml HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:25 +0000] "GET /dump.sql HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:25 +0000] "GET /.git/refs/heads/main HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:27 +0000] "GET /html/.env HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:28 +0000] "GET /src/environments/environment.production.ts HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:28 +0000] "GET /src/config.ts HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [03/Nov/2026:13:26:30 +0000] "GET /application-staging.yml HTTP/1.1" 404 162 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.1
...
show less
Port Scan
Web App Attack
🇩🇪
spirttm
2026-11-02 21:28:07
UTC ·
(1 week ago)
4.155.208.129 - - [02/Nov/2026:21:27:52 +0000] "GET /.env.local HTTP/1.1" 403 153 "https://138.199.159.42/" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
4.155.208.129 - - [02/Nov/2026:21:27:53 +0000] "GET /.env.local/ HTT ...
show more
4.155.208.129 - - [02/Nov/2026:21:27:52 +0000] "GET /.env.local HTTP/1.1" 403 153 "https://138.199.159.42/" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
4.155.208.129 - - [02/Nov/2026:21:27:53 +0000] "GET /.env.local/ HTTP/1.1" 403 153 "https://138.199.159.42/" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
4.155.208.129 - - [02/Nov/2026:21:27:54 +0000] "GET /.env.old/ HTTP/1.1" 403 555 "https://138.199.159.42/" "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/159.0.8277.102 Mobile Safari/537.36"
4.155.208.129 - - [02/Nov/2026:21:27:57 +0000] "GET /.env.old; HTTP/1.1" 403 555 "https://138.199.159.42/" "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/159.0.8277.102 Mobile Safari/537.36"
4.155.208.129 - - [02/Nov/2026:21:27:58 +0000] "GET /.env.1 HTTP/1.1" 403 153 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [02/Nov/2026:21:27:59 +
...
show less
Port Scan
Web App Attack
🇩🇪
jeannelboutique
2026-11-02 18:20:59
UTC ·
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted] 4.155.208.129 (US/United States/-)
SQL Injection
🇩🇪
edena
2026-11-02 06:20:04
UTC ·
(1 week ago)
4.155.208.129 - - [02/Nov/2026:07:20:01 +0100] "GET /.env~ HTTP/1.1" 403 358 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [02/Nov/2026:07:20:01 +0100] "GET /env.backup HTTP/1.1" 403 358 "-" "ExposureScanner/1.0 (internal-secu ...
show more
4.155.208.129 - - [02/Nov/2026:07:20:01 +0100] "GET /.env~ HTTP/1.1" 403 358 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [02/Nov/2026:07:20:01 +0100] "GET /env.backup HTTP/1.1" 403 358 "-" "ExposureScanner/1.0 (internal-security-audit)"
4.155.208.129 - - [02/Nov/2026:07:20:04 +0100] "GET /.htpasswd HTTP/1.1" 403 358 "-" "ExposureScanner/1.0 (internal-security-audit)"
...
show less
Web App Attack
Bad Web Bot