🇧🇪
cmbplf
2026-11-10 06:35:21
UTC ·
(4 minutes ago)
110 requests with url.path *.env
Brute-Force
Bad Web Bot
2026-11-10 04:06:50
UTC ·
(2 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/appsec-vpatch; Action=ban; Events=2; Country=TH; ASN=132203 Tencent Building, Kejizhongyi Avenue
Hacking
2026-11-10 03:07:17
UTC ·
(3 hours ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-sensitive-files; Action=ban; Events=5; Hosts=portal.incognet.io; Paths=/.env,/.env.development,/.env.local,/.env.staging,/.git/config; Country=TH; ASN=132203 Tencent Building, Kejizhon ...
show more
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-sensitive-files; Action=ban; Events=5; Hosts=portal.incognet.io; Paths=/.env,/.env.development,/.env.local,/.env.staging,/.git/config; Country=TH; ASN=132203 Tencent Building, Kejizhongyi Avenue
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-11-09 23:26:53
UTC ·
(7 hours ago)
Secret file probe | method: GET | path: /.git/config | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking
Web App Attack
🇫🇷
900cm
2026-11-09 18:46:48
UTC ·
(11 hours ago)
[Mon Nov 09 19:46:47.587205 2026] [access_compat:error] [pid 1023039:tid 1023039] [client 43.128.199.182:35186] AH01797: client denied by server configuration: /var/www/darkintruder/.git
[Mon Nov 09 19:46:47.951689 2026] [access_compat:error] [pid 10 ...
show more
[Mon Nov 09 19:46:47.587205 2026] [access_compat:error] [pid 1023039:tid 1023039] [client 43.128.199.182:35186] AH01797: client denied by server configuration: /var/www/darkintruder/.git
[Mon Nov 09 19:46:47.951689 2026] [access_compat:error] [pid 1023039:tid 1023039] [client 43.128.199.182:35186] AH01797: client denied by server configuration: /var/www/darkintruder/.env
[Mon Nov 09 19:46:48.132895 2026] [access_compat:error] [pid 1023039:tid 1023039] [client 43.128.199.182:35186] AH01797: client denied by server configuration: /var/www/darkintruder/.env.local
...
show less
Port Scan
Brute-Force
SSH
🇳🇱
Site.eu
2026-11-08 13:02:40
UTC ·
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-11-08 02:50:12
UTC ·
(2 days ago)
Malicious web traffic detected by CrowdSec
Hacking
🇩🇪
kkw
2026-11-08 01:13:09
UTC ·
(2 days ago)
[REDACTED] 43.128.199.182 - - [08/Nov/2026:02:13:08 +0100] "GET /.git/config HTTP/1.1" 404 557 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
... (mode: searching http-sensi ...
show more
[REDACTED] 43.128.199.182 - - [08/Nov/2026:02:13:08 +0100] "GET /.git/config HTTP/1.1" 404 557 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
... (mode: searching http-sensitive-files)
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 23:49:30
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 43.128.199.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:49:23.589715 2026] [security2:error] [pid 14681:tid 14681] [client 43.128.199.182:44610] ...
show more
(mod_security) mod_security (id:210492) triggered by 43.128.199.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:49:23.589715 2026] [security2:error] [pid 14681:tid 14681] [client 43.128.199.182:44610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "darkalleyproductions.com"] [uri "/.git/config"] [unique_id "au-5A97O_qTRpfq3xujc9wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-07 23:36:58
UTC ·
(2 days ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇫🇷
Danguole Rasalaite Memorial 🇱🇹
2026-11-07 16:07:59
UTC ·
(2 days ago)
[SOC-ALERT: VULN-SCANNER] Automated reconnaissance probe intercepted by Nginx web application filter. Vector: Targeted probing for sensitive or hidden resources (including .env files, .git repositories, Docker manifests, credentials or backup archive ...
show more
[SOC-ALERT: VULN-SCANNER] Automated reconnaissance probe intercepted by Nginx web application filter. Vector: Targeted probing for sensitive or hidden resources (including .env files, .git repositories, Docker manifests, credentials or backup archives) | MITRE ATT&CK: T1595.002 (Active Scanning: Vulnerability Scanning). Enforcement: IP banned across all ports (24h quarantine). Automated threat intelligence telemetry.
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-06 22:59:12
UTC ·
(3 days ago)
Auto-ban: >3000 req/min op 2026-11-06
Web App Attack
SSH
Hacking
🇳🇱
Savvii
2026-11-06 20:38:57
UTC ·
(3 days ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-06 20:29:06
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇨🇭
Cybercat
2026-11-06 13:15:17
UTC ·
(3 days ago)
CrowdSec detection: crowdsecurity/http-sensitive-files
Hacking
