🇪🇸
Gem
2025-01-31 23:55:59
UTC ·
(1 year ago)
Unauthorized web scan.
Web App Attack
🇨🇭
Peter-Johann Sarbach
2025-01-30 10:31:22
UTC ·
(1 year ago)
hacking
Hacking
🇺🇸
WebRanger
2025-01-29 12:07:14
UTC ·
(1 year ago)
GET /.env HTTP/1.1 403 532 "- GET /.env HTTP/1.1" 403 532 "-" "Mozilla/5.0 Keydrop" "-
Web App Attack
🇺🇸
chronos
2025-01-29 12:05:38
UTC ·
(1 year ago)
[AUTORAVALT][[29/01/2025 - 09:05:38 -03:00 UTC]
Attack from [DigitalOcean, LLC]
[68.183.47.165] Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such ...
show more
[AUTORAVALT][[29/01/2025 - 09:05:38 -03:00 UTC]
Attack from [DigitalOcean, LLC]
[68.183.47.165] Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software plug]
...
show less
Hacking
Web App Attack
2025-01-29 11:54:28
UTC ·
(1 year ago)
Reported from Nginx log analysis 19. Log: 68.183.47.165 - - [29/Jan/2025:xx:xx:xx 0000] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 Keydrop" "-" "GB United Kingdom Slough" "AS14061" "DIGITALOCEAN-ASN" | 68.183.47.165 - - [29/Jan/2025:xx:xx:xx 000 ...
show more
Reported from Nginx log analysis 19. Log: 68.183.47.165 - - [29/Jan/2025:xx:xx:xx 0000] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 Keydrop" "-" "GB United Kingdom Slough" "AS14061" "DIGITALOCEAN-ASN" | 68.183.47.165 - - [29/Jan/2025:xx:xx:xx 0000] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 Keydrop" "-" "GB United Kingdom Slough" "AS14061" "DIGITALOCEAN-ASN"
show less
Port Scan
Brute-Force
SSH
🇫🇷
LRNP
2025-01-29 11:32:36
UTC ·
(1 year ago)
_:443 68.183.47.165 - - [29/Jan/2025:11:32:30 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 Keydrop"
...
Bad Web Bot
Web App Attack
🇸🇪
SkyDancer
2025-01-29 11:27:49
UTC ·
(1 year ago)
Multiple web intrusion attempts or RDP/SSH hacking using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Ai-D
Hacking
Brute-Force
SSH
🇦🇹
services.org.pl
2025-01-29 11:19:04
UTC ·
(1 year ago)
open() "/var/www/html/.env" failed (2: No such file or directory), client: 68.183.47.165, server: api.services.org.pl, request: "GET /.env HTTP/1.1", host: "46.102.157.176"
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-01-29 11:09:18
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 06:09:15.365905 2025] [security2:error] [pid 9722:tid 9722] [client 68.183.47.165:50552] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 06:09:15.365905 2025] [security2:error] [pid 9722:tid 9722] [client 68.183.47.165:50552] [client 68.183.47.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.74"] [uri "/.env"] [unique_id "Z5oMW7Rhs7hqRUhO77OEFgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇬
pa4080
2025-01-29 11:01:56
UTC ·
(1 year ago)
Detected by ModSecurity. Request URI: /.env
Web App Attack
🇩🇪
taivas.nl
2025-01-29 11:00:08
UTC ·
(1 year ago)
General bad request
Bad Web Bot
🇺🇸
TPI-Abuse
2025-01-29 10:46:10
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 05:46:04.238676 2025] [security2:error] [pid 3183:tid 3183] [client 68.183.47.165:37178] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 05:46:04.238676 2025] [security2:error] [pid 3183:tid 3183] [client 68.183.47.165:37178] [client 68.183.47.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.37"] [uri "/.env"] [unique_id "Z5oG7NRcut6kckS9JN5_uQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Security_Whaller
2025-01-29 10:43:53
UTC ·
(1 year ago)
Malicious activity detected on Honeypot.
Hacking
Brute-Force
Web App Attack
🇺🇸
jkhorvath
2025-01-29 10:19:55
UTC ·
(1 year ago)
Request for URL /.env
Phishing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-01-29 10:12:51
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 05:12:48.702511 2025] [security2:error] [pid 5912:tid 5912] [client 68.183.47.165:32958] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 68.183.47.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 29 05:12:48.702511 2025] [security2:error] [pid 5912:tid 5912] [client 68.183.47.165:32958] [client 68.183.47.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.192"] [uri "/.env"] [unique_id "Z5n_IJ066nib7Rm8HbMWeAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack