🇩🇪
big-cloud.nl
2026-10-19 20:49:53
(1 day ago)
Try to access /.env
Web App Attack
🇩🇪
altenglaner
2026-10-19 07:46:18
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-10-19 04:55:53
(1 day ago)
Secret file probe | method: GET | path: /.env | ua: -
Hacking
Web App Attack
🇦🇺
Block Rockin' Beats
2026-10-18 10:27:04
(2 days ago)
Scanning for exploitable scripts
Hacking
Web App Attack
🇩🇪
Phenix Info
2026-10-17 11:39:05
(3 days ago)
SmallGuard.fr/Prestashop Empty User Agent
Web App Attack
🇩🇪
iNetWorker
2026-10-16 01:17:12
(5 days ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 06:21:10
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:21:03.171430 2026] [security2:error] [pid 17926:tid 17926] [client 74.208.56.189:42962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "handyrehab.com"] [uri "/.env"] [unique_id "arYSz4yVu_QCSZxamZxi4QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-25 05:31:14
(3 weeks ago)
Try to access /.env
Web App Attack
🇩🇪
Phenix Info
2026-09-23 07:23:15
(3 weeks ago)
SmallGuard.fr/Prestashop Empty User Agent
Web App Attack
🇩🇪
Carsten
2026-09-22 22:11:15
(4 weeks ago)
GET [wp-config.php.bak]
Port Scan
🇺🇸
TPI-Abuse
2026-09-22 21:35:36
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 17:35:30.151018 2026] [security2:error] [pid 9023:tid 9023] [client 74.208.56.189:41780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alexgitlin.com"] [uri "/wp-config.php.bak"] [unique_id "arL0olpw9m0p_UkW05BmdwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-09-22 17:54:03
(4 weeks ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /wp-config\.php (Match: /wp-config.php)
show less
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:41:38
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:41:30.196501 2026] [security2:error] [pid 29893:tid 29893] [client 74.208.56.189:40584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thugdoggsrecords.com"] [uri "/wp-config.php.bak"] [unique_id "arK9ykEcjw1xcrTDO-KAVAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:50:04
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:49:57.591215 2026] [security2:error] [pid 6111:tid 6111] [client 74.208.56.189:58424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dmasoftlab.com"] [uri "/wp-config.php.bak"] [unique_id "arKjpaPA_AGBy18UaUfyBwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:48:17
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.56.189 (infong455.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:48:09.822201 2026] [security2:error] [pid 5447:tid 5447] [client 74.208.56.189:43878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scc1.us"] [uri "/parked/wp-config.php.bak"] [unique_id "arKHGYNDOwzOKuU63At7cQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
