🇳🇱
Site.eu
2026-11-08 10:49:24
UTC ·
(10 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-11-07 23:19:00
UTC ·
(21 hours ago)
Brute-Force
Web App Attack
2026-11-07 16:28:46
UTC ·
(1 day ago)
Banned by Fail2Ban on server
Web App Attack
🇩🇪
macrob
2026-11-07 13:44:41
UTC ·
(1 day ago)
2026/11/07 13:44:39 [error] 264515#264515: *12638132 access forbidden by rule, client: 43.128.199.69, server: finami.mx, request: "GET /.git/config HTTP/2.0", host: "finami.mx"
2026/11/07 13:44:40 [error] 264517#264517: *12641396 access forbidden by ...
show more
2026/11/07 13:44:39 [error] 264515#264515: *12638132 access forbidden by rule, client: 43.128.199.69, server: finami.mx, request: "GET /.git/config HTTP/2.0", host: "finami.mx"
2026/11/07 13:44:40 [error] 264517#264517: *12641396 access forbidden by rule, client: 43.128.199.69, server: finami.mx, request: "GET /.env HTTP/2.0", host: "finami.mx"
2026/11/07 13:44:40 [error] 264516#264516: *12640932 access forbidden by rule, client: 43.128.199.69, server: finami.mx, request: "GET /.env.local HTTP/2.0", host: "finami.mx"
...
show less
Web App Attack
🇬🇧
consul.to
2026-11-07 02:29:06
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇪🇸
pipeline.es
2026-11-07 00:54:39
UTC ·
(1 day ago)
Web scanning / probing for vulnerable paths | URL: /administrator/.env | Evidence: feitoparaviajar.com.br 43.128.199.69 - - [07/Nov/2026:01:54:24 +0100] \"GET /administrator/.env HTTP/1.1\" 404 19764 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKi ...
show more
Web scanning / probing for vulnerable paths | URL: /administrator/.env | Evidence: feitoparaviajar.com.br 43.128.199.69 - - [07/Nov/2026:01:54:24 +0100] \"GET /administrator/.env HTTP/1.1\" 404 19764 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" GEOIP_COUNTRY_CODE=TH 19935 | ASN: Tencent Building, Kejizhongyi Avenue | Country: TH
show less
Port Scan
Web App Attack
🇩🇪
FeG Deutschland
2026-11-07 00:19:56
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 19:51:14
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:51:07.572760 2026] [security2:error] [pid 22720:tid 22720] [client 43.128.199.69:52744] M ...
show more
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:51:07.572760 2026] [security2:error] [pid 22720:tid 22720] [client 43.128.199.69:52744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chateau-saleza-bruges.com"] [uri "/.git/config"] [unique_id "au4vq5BScbD4AD5VStxYPwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 16:00:11
UTC ·
(2 days ago)
| [Dangerous/Thailand] Aggressive IP 43.128.199.69 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-11-06 08:30:56
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:30:48.163767 2026] [security2:error] [pid 8324:tid 8324] [client 43.128.199.69:42054] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:30:48.163767 2026] [security2:error] [pid 8324:tid 8324] [client 43.128.199.69:42054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "forestvalleyfarm.com"] [uri "/.git/config"] [unique_id "au2QOLCFanm6rEg8eVcFcwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-06 04:04:20
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-11-06 01:18:41
UTC ·
(2 days ago)
43.128.199.69 - - [06/Nov/2026:02:18:40 +0100] "GET /.git/config HTTP/1.1" 404 577 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 19:18:15
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:18:11.620702 2026] [security2:error] [pid 27839:tid 27839] [client 43.128.199.69:35804] M ...
show more
(mod_security) mod_security (id:210492) triggered by 43.128.199.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 14:18:11.620702 2026] [security2:error] [pid 27839:tid 27839] [client 43.128.199.69:35804] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.eatcakecup.com"] [uri "/.git/config"] [unique_id "auzWc1j25W3s0rLeQU7YpgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-05 18:56:46
UTC ·
(3 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
raph
2026-11-05 15:25:09
UTC ·
(3 days ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
