🇩🇪
Céline
2026-05-20 01:10:45
(2 weeks ago)
Shield Guard: Blocklist: IP signalée (blocklist_de) | AbuseIPDB: 100% (très malveillant) | Honeypot: ...
show more
Shield Guard: Blocklist: IP signalée (blocklist_de) | AbuseIPDB: 100% (très malveillant) | Honeypot: /.env.save
show less
Web App Attack
🇩🇪
sdos.es
2026-05-20 01:10:43
(2 weeks ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"
Web App Attack
🇮🇹
mgarofano80
2026-05-20 01:09:18
(2 weeks ago)
Brute-Force
Web App Attack
🇬🇧
andypiper
2026-05-20 01:01:44
(2 weeks ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
ManagedStack
2026-05-20 01:00:01
(2 weeks ago)
Probing access to unauthorized locations
Hacking
Exploited Host
Web App Attack
🇩🇪
kivitendo.de
2026-05-20 00:46:44
(2 weeks ago)
[Wed May 20 02:46:43.754935 2026] [access_compat:error] [pid 1164:tid 1209] [client 45.135.193.156:4 ...
show more
[Wed May 20 02:46:43.754935 2026] [access_compat:error] [pid 1164:tid 1209] [client 45.135.193.156:49246] AH01797: client denied by server configuration: /var/www/kivitendo-erp/config/.env
[Wed May 20 02:46:44.885007 2026] [access_compat:error] [pid 1164:tid 1207] [client 45.135.193.156:49246] AH01797: client denied by server configuration: /var/www/kivitendo-erp/config/aws-secrets.env
...
show less
Brute-Force
Web App Attack
🇩🇪
barbarella
2026-05-20 00:43:08
(2 weeks ago)
Multiple (32) times attack on https port 443: Configuration snooping with .env file (GET /.env)
0 ...
show more
Multiple (32) times attack on https port 443: Configuration snooping with .env file (GET /.env)
00:43:09 Configuration snooping with .env file (GET /api/.env)
00:43:09 Configuration snooping with .env file (GET /backend/.env)
00:43:09 PHP Configuration snooping with phpinfo file (GET /phpinfo.php)
00:43:09 PHP Configuration snooping with phpinfo file (GET /phpinfo/)
00:43:09 Configuration snooping with .env file (GET /admin/.env)
00:43:09 Configuration snooping with .env file (GET /laravel/.env)
00:43:09 searching for Cobalt Strike server beacon (GET /test)
00:43:09 Configuration snooping with modified .env.* file (GET /.env.example)
show less
Hacking
Web App Attack
2026-05-20 00:13:50
(2 weeks ago)
2026/05/20 00:13:47 [error] 540#540: *38741 [client 45.135.193.156] ModSecurity: Access denied with ...
show more
2026/05/20 00:13:47 [error] 540#540: *38741 [client 45.135.193.156] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `11' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `13' ) [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.16.0"] [maturity "0"] [accuracy "0"] [tag "modsecurity"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "82.84.91.211"] [uri "/phpinfo.php"] [unique_id "177923602711.809815"] [ref ""], client: 45.135.193.156, server: homesex.casa, request: "GET /phpinfo.php HTTP/1.1", host: "82.84.91.211"
2026/05/20 00:13:49 [error] 540#540: *38741 [client 45.135.193.156] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `11' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `13' ) [file "/etc/modsecurity
...
show less
Hacking
Web App Attack
🇳🇱
Savvii
2026-05-20 00:07:32
(2 weeks ago)
29 attempts against mh-misbehave-ban on argon
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
leryon
2026-05-20 00:00:45
(2 weeks ago)
IP: 45.135.193.156 sends in the last 24 hours 4 invalid requests over 80
Hacking
Web Spam
🇧🇷
diego
2026-05-20 00:00:41
(2 weeks ago)
[probe-44-49] 2026-05-19 23:43:52, Client: 45.135.193.156, Protocol: 6, Unauthorized activity to HTT ...
show more
[probe-44-49] 2026-05-19 23:43:52, Client: 45.135.193.156, Protocol: 6, Unauthorized activity to HTTP: GET /.env
show less
Web App Attack
🇫🇮
mnazibo
2026-05-20 00:00:17
(2 weeks ago)
Date: 20/May/2026 02:17:00 | Reported IP: 45.135.193.156 mod_security | id: 930130 | DE/group.my_dom ...
show more
Date: 20/May/2026 02:17:00 | Reported IP: 45.135.193.156 mod_security | id: 930130 | DE/group.my_domain/- | Connections: 4 | Blocked: Permanent Block: [LF_MODSEC] | URIs: /dashboard/backend/.env; /dev/.env; /electron/.env.packaged; /etc/php/.env | Logs: Restricted File Access Attempt
show less
SQL Injection
Brute-Force
Bad Web Bot
🇺🇸
gamabe
2026-05-19 23:42:42
(2 weeks ago)
Detected crowdsecurity/http-sensitive-files attack pattern. Reported by CrowdSec IDS.
Hacking
🇺🇸
aks4226
2026-05-19 23:38:32
(2 weeks ago)
Bot search, attacking common web applications.
Web App Attack
🇳🇱
Savvii
2026-05-19 23:06:19
(2 weeks ago)
20 attempts against mh-misbehave-ban on argon
Brute-Force
Bad Web Bot
Web App Attack