🇳🇱
homeshowdomain.nl
2026-06-15 22:03:31
(6 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-14.
show less
Web App Attack
SSH
Hacking
🇫🇷
dynamix
2026-06-15 08:03:28
(6 days ago)
Multiple WAF Violations
Web App Attack
🇪🇸
pipeline.es
2026-06-15 07:26:55
(6 days ago)
Web scanning / probing for vulnerable paths | URL: /tmp/.env | Evidence: altovolta.es 8.229.24.140 - ...
show more
Web scanning / probing for vulnerable paths | URL: /tmp/.env | Evidence: altovolta.es 8.229.24.140 - - [15/Jun/2026:09:26:03 +0200] \"GET /tmp/.env HTTP/1.1\" 404 206 \"-\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\" GEOIP_COUNTRY_CODE=US | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 06:54:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 02:54:31.106250 2026] [security2:error] [pid 18142:tid 18142] [client 8.229.24.140:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rodrigoaldecoa.com"] [uri "/.env.prod"] [unique_id "ai-hp9QDPNZocsTG-MuQ8wAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-06-15 05:43:20
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 02:56:00
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 22:55:56.656277 2026] [security2:error] [pid 21266:tid 21266] [client 8.229.24.140:49638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nationalnova.com.sprektech.com"] [uri "/api/.env"] [unique_id "ai9pvB4fYGBxsouT9zDgTQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Cloud86 B.V.
2026-06-15 02:52:06
(1 week ago)
categories: DDoS Attack
DDoS Attack
🇺🇸
mnsf
2026-06-15 01:05:51
(1 week ago)
Abuse Detected (68)
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-06-15 01:01:11
(1 week ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
2026-06-14 23:40:14
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:35:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:35:29.874305 2026] [security2:error] [pid 14484:tid 14484] [client 8.229.24.140:56262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lawson-insurance.com"] [uri "/.env.local.bak"] [unique_id "ai86wdewSNVNi-udxgy75wAAADg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:08:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:08:11.365418 2026] [security2:error] [pid 4761:tid 4761] [client 8.229.24.140:43104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cuch.net"] [uri "/.env.backup"] [unique_id "ai80W_yyWh377bdF5QphogAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
itsvic.dev
2026-06-14 22:15:05
(1 week ago)
8.229.24.140 - - [14/Jun/2026:22:15:03 +0000] "GET /api/.env.bak HTTP/1.1" 200 445 "-" "Mozilla/5.0 ...
show more
8.229.24.140 - - [14/Jun/2026:22:15:03 +0000] "GET /api/.env.bak HTTP/1.1" 200 445 "-" "Mozilla/5.0 (Linux; Android 9; Nokia 7.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36"
8.229.24.140 - - [14/Jun/2026:22:15:04 +0000] "GET /.env.old HTTP/1.1" 200 445 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110622 Firefox/6.0a2"
8.229.24.140 - - [14/Jun/2026:22:15:04 +0000] "GET /.env HTTP/1.1" 200 445 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇩🇪
4server
2026-06-14 10:09:04
(1 week ago)
[SunJun1412:09:01.2065562026][security2:error][pid2397640:tid2397704][client8.229.24.140:0]ModSecuri ...
show more
[SunJun1412:09:01.2065562026][security2:error][pid2397640:tid2397704][client8.229.24.140:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:10\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.modularss.mood4apps.com\"][uri\"/.env.txt\"][unique_id\"ai59vRdi3Jy3jZW4V58rKAAAAIM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 05:46:38
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 8.229.24.140 (140.24.229.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 01:46:32.342488 2026] [security2:error] [pid 2379:tid 2379] [client 8.229.24.140:51014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tlphotogifts.com.iyp-home.com"] [uri "/.env.txt"] [unique_id "ai5AOGpkCnARb_Cfn-Qk0AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack