🇳🇱
Site.eu
2026-11-07 08:01:52
UTC ·
(3 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
verlon
2026-11-07 01:01:15
UTC ·
(10 hours ago)
2026/11/07 02:00:50 [error] 403238#403238: *527724 access forbidden by rule, client: 43.166.194.80, server: gcomfort.hu, request: "GET /.git/config HTTP/2.0", host: "gcomfort.hu"
2026/11/07 02:01:08 [error] 403238#403238: *527724 access forbidden by ...
show more
2026/11/07 02:00:50 [error] 403238#403238: *527724 access forbidden by rule, client: 43.166.194.80, server: gcomfort.hu, request: "GET /.git/config HTTP/2.0", host: "gcomfort.hu"
2026/11/07 02:01:08 [error] 403238#403238: *527724 access forbidden by rule, client: 43.166.194.80, server: gcomfort.hu, request: "GET /.env.bak HTTP/2.0", host: "gcomfort.hu"
2026/11/07 02:01:12 [error] 403238#403238: *527724 access forbidden by rule, client: 43.166.194.80, server: gcomfort.hu, request: "GET /.env.save HTTP/2.0", host: "gcomfort.hu"
...
show less
Hacking
Web App Attack
2026-11-07 00:55:35
UTC ·
(10 hours ago)
Automatically blocked after 4 security events. Observed sensitive configuration-file probes. Source: Cloudflare security controls.
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-06 22:52:10
UTC ·
(12 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
tecnoacquisti.com
2026-11-06 17:58:55
UTC ·
(17 hours ago)
PrestaShop Security Module: suspicious probe path detected (/phpinfo.php)
Web App Attack
2026-11-06 17:27:31
UTC ·
(17 hours ago)
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "POST ...
show more
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "GET /.git/config HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:19:27:29 +0200] "GET /.env HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43
...
show less
Bad Web Bot
Web App Attack
2026-11-06 14:54:42
UTC ·
(20 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
IVski.com
2026-11-06 14:48:56
UTC ·
(20 hours ago)
IVski WAF | Next.js Server Action probe
Hacking
Brute-Force
Web App Attack
🇨🇦
CentiDevOps
2026-11-06 12:22:17
UTC ·
(22 hours ago)
Web app scan: 18 requests in 2 s across 3 domains (301/404). Paths: /.git/config, /fr/.git/config, /.env (+4 more). Sample: 2026-11-06T12:22:17Z "GET /.git/config" 301
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-11-06 10:42:19
UTC ·
(1 day ago)
Try to access /.git/config
Web App Attack
2026-11-06 08:11:07
UTC ·
(1 day ago)
GET /.git/config HTTP/1.1
...
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 07:29:05
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 43.166.194.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:28:58.555646 2026] [security2:error] [pid 27378:tid 27378] [client 43.166.194.80:35114] M ...
show more
(mod_security) mod_security (id:210492) triggered by 43.166.194.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 02:28:58.555646 2026] [security2:error] [pid 27378:tid 27378] [client 43.166.194.80:35114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fundpeace.org.ampro.link"] [uri "/.git/config"] [unique_id "au2BuqmGZO3BdpiASZtvtQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-11-06 06:15:55
UTC ·
(1 day ago)
161 attacks on PHP URLs, VC URLs, env grabbing URLs:
GET /smtp/phpinfo.php HTTP/1.1
GET /.git/config HTTP/1.1
GET /bulk/.env HTTP/1.1
Web App Attack
Hacking
🇺🇸
mnsf
2026-11-06 06:05:21
UTC ·
(1 day ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇩🇪
loveprod
2026-11-06 04:48:26
UTC ·
(1 day ago)
43.166.194.80 - - [06/Nov/2026:07:48:24 +0300] "GET /.git/config HTTP/2.0" 301 89 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:07:48:25 +0300] "GET /.git/co ...
show more
43.166.194.80 - - [06/Nov/2026:07:48:24 +0300] "GET /.git/config HTTP/2.0" 301 89 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
43.166.194.80 - - [06/Nov/2026:07:48:25 +0300] "GET /.git/config HTTP/2.0" 404 8368 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
