2026-10-20 22:30:13
(6 hours ago)
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web s ...
show more
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
show less
Web App Attack
Bad Web Bot
🇩🇪
big-cloud.nl
2026-10-19 14:55:03
(1 day ago)
Try to access /.env
Web App Attack
🇯🇵
Valhalla
2026-10-19 08:52:45
(1 day ago)
/.env
Hacking
Web App Attack
🇩🇪
altenglaner
2026-10-19 04:37:32
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-10-19 02:49:27
(2 days ago)
Secret file probe | method: GET | path: /.env | ua: -
Hacking
Web App Attack
🇺🇸
OceanTreasure
2026-09-24 06:07:40
(3 weeks ago)
tcp/80; Automated ZIP archive enumeration scan: "GET /bitcoin.zip" @ 2026-09-24T06:07:40Z [proxy]
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 21:25:15
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 17:25:09.020765 2026] [security2:error] [pid 21532:tid 21532] [client 74.208.58.38:40488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.beckersystems.com"] [uri "/partners/businesstobusinessassociation.com/ilc/wp-config.php.bak"] [unique_id "arLyNYMR4qDjx5mLVWO6nAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-22 20:46:08
(4 weeks ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 74.208.58.38 - - [22/Sep/2026:22:46:07 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 459 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:38:43
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:38:37.730800 2026] [security2:error] [pid 1229180:tid 1229180] [client 74.208.58.38:44320] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thehudsonpress.com"] [uri "/wp-config.php.bak"] [unique_id "arLZPdtHXh9SwD-9TDf5YgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:29:18
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:29:14.817750 2026] [security2:error] [pid 451:tid 451] [client 74.208.58.38:58294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "midnight-tech.com"] [uri "/wp-config.php.bak"] [unique_id "arLI-n4mg1JB-p7rI8dWeAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:30:00
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:29:56.321672 2026] [security2:error] [pid 21385:tid 21385] [client 74.208.58.38:50410] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "form-a-tool.com"] [uri "/wp-config.php.bak"] [unique_id "arKtBDh7Xki52zrfDD5onQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:00:23
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:00:20.601196 2026] [security2:error] [pid 12743:tid 12743] [client 74.208.58.38:45092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "maverickhousellc.com"] [uri "/wp-config.php.bak"] [unique_id "arKmFIkQt0lyR5GKiWNM7AAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-09-22 14:22:28
(4 weeks ago)
[Wed Sep 23 00:22:27.847835 2026] [security2:error] [pid 242769] [client 74.208.58.38:47350] [client ...
show more
[Wed Sep 23 00:22:27.847835 2026] [security2:error] [pid 242769] [client 74.208.58.38:47350] [client 74.208.58.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dlcarterauthor.com"] [uri "/wp-config.php.bak"] [unique_id "arKPI7DYos8M7kePccGCIwAAAAk"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 11:55:30
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in t ...
show more
(mod_security) mod_security (id:210492) triggered by 74.208.58.38 (infongp-us47.perfora.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 07:55:27.719097 2026] [security2:error] [pid 29335:tid 29335] [client 74.208.58.38:35240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oiseauxsisters.com"] [uri "/wp-config.php.bak"] [unique_id "arJsr26IzXX1HcTs35Su7wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-09-22 09:51:52
(4 weeks ago)
cloudlinux2 fail2ban: 2026-09-22 11:03:53,670 fail2ban.filter [1598]: INFO [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-09-22 11:03:53,670 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 49.201.37.74 - 2026-09-22 11:03:53cloudlinux2 fail2ban: 2026-09-22 11:03:54,293 fail2ban.actions [1598]: NOTICE [plesk-modsecurity] Ban 49.201.37.74cloudlinux2 fail2ban: 2026-09-22 11:03:54,298 fail2ban.filter [1598]: INFO [recidive] Found 49.201.37.74 - 2026-09-22 11:03:54cloudlinux2 fail2ban: 2026-09-22 11:04:33,555 fail2ban.actions [1598]: NOTICE [plesk-modsecurity] Unban 84.15.188.115cloudlinux2 fail2ban: 2026-09-22 11:04:47,657 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 109.206.120.252 - 2026-09-22 11:04:47cloudlinux2 fail2ban: 2026-09-22 11:04:47,645 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 109.206.120.252 - 2026-09-22 11:04:47cloudlinux2 fail2ban: 2026-09-22 11:04:53,578 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 172.86.81.67 - 2026-09-22 11:04:53cloudlinux2 fail2ban: 2026-09-22 11:05:13,006 fail
show less
Web App Attack
