🇫🇷
SpaceHost-Server
2026-10-21 22:25:30
(3 days ago)
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-10-21 00:23:23
(4 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-10-20 23:50:18
(4 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-20 22:22:20
(4 days ago)
Brute-Force
Web App Attack
🇺🇸
dot.mg
2026-10-20 22:02:02
(4 days ago)
Scan of vulnerable files
Web App Attack
🇵🇱
Budyn
2026-10-20 21:02:23
(4 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: forum.teddypot.online | URI: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
iwle
2026-10-20 19:27:30
(4 days ago)
[Tue Oct 20 15:27:27.551060 2026] [:error] [pid 208195:tid 208302] [client 5.249.179.171:0] [client ...
show more
[Tue Oct 20 15:27:27.551060 2026] [:error] [pid 208195:tid 208302] [client 5.249.179.171:0] [client 5.249.179.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "uvscards.com"] [uri "/.env"] [unique_id "atfAn11fQHZALwQeeRq9JgAAAAI"]
[Tue Oct 20 15:27:28.181149 2026] [:error] [pid 208565:tid 208600] [client 5.249.179.171:0] [client 5.249.179.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[
...
show less
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-20 16:51:06
(5 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-20 UTC.
Brute-Force
🇧🇷
radardatelecom
2026-10-20 14:18:02
(5 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇴
Bots.go.to.hell
2026-10-20 14:16:59
(5 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access
Web App Attack
Hacking
🇩🇪
macrob
2026-10-20 11:49:55
(5 days ago)
2026/10/20 11:49:53 [error] 2543952#2543952: *18383032 access forbidden by rule, client: 5.249.179.1 ...
show more
2026/10/20 11:49:53 [error] 2543952#2543952: *18383032 access forbidden by rule, client: 5.249.179.171, server: finami.es, request: "GET /.env HTTP/2.0", host: "finami.es"
2026/10/20 11:49:54 [error] 2543953#2543953: *18383408 access forbidden by rule, client: 5.249.179.171, server: finami.es, request: "GET /.env.staging HTTP/2.0", host: "finami.es"
2026/10/20 11:49:54 [error] 2543955#2543955: *18386493 access forbidden by rule, client: 5.249.179.171, server: finami.es, request: "GET /.env.local HTTP/2.0", host: "finami.es"
...
show less
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-10-20 09:08:02
(5 days ago)
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice01,ice02,wa01,wa02 ...
show more
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice01,ice02,wa01,wa02]
show less
Hacking
SQL Injection
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-10-20 07:10:05
(5 days ago)
Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [wa01]
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 07:06:37
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 5.249.179.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 5.249.179.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 03:06:29.100954 2026] [security2:error] [pid 26933:tid 26944] [client 5.249.179.171:34829] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tomskrodzki.com"] [uri "/.env"] [unique_id "atcS9fn_GtV6aKqgOdtrcQAAAIg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
Megasurf
2026-10-20 06:04:42
(5 days ago)
web application attack (blocked by the web application firewall). Blocked automatically by our firew ...
show more
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
show less
Web App Attack
