🇳🇱
homeshowdomain.nl
2026-07-17 21:59:07
(57 minutes ago)
Auto-ban: >3000 req/min op 2026-07-17
Web App Attack
SSH
Hacking
🇨🇭
TheCoon
2026-07-17 20:45:01
(2 hours ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-07-17 17:06:38
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 13:06:30.681195 2026] [security2:error] [pid 31875:tid 31875] [client 80.225.195.237:41980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "inmosantanora.com"] [uri "/.env.prod"] [unique_id "alphFrTOnKh1FMdTdIS_1gAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dtorrer
2026-07-17 16:03:52
(6 hours ago)
General vulnerability scan.
Port Scan
🇺🇸
TPI-Abuse
2026-07-17 12:36:42
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 08:36:37.447375 2026] [security2:error] [pid 259280:tid 259280] [client 80.225.195.237:47718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staging.thewhispertwins.com"] [uri "/.env.production"] [unique_id "aloh1X4pBhq713ihJAjOqgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-17 12:18:30
(10 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
zwebvigil
2026-07-17 12:11:40
(10 hours ago)
80.225.195.237 [17/Jul/2026:05:11:35 -0700] "GET /.env.swp HTTP/1.1" 404 22 "-" port=14394 "Mozilla ...
show more
80.225.195.237 [17/Jul/2026:05:11:35 -0700] "GET /.env.swp HTTP/1.1" 404 22 "-" port=14394 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" "-" "-" "<host>" 4728
80.225.195.237 [17/Jul/2026:05:11:35 -0700] "GET /.env~ HTTP/1.1" 404 22 "-" port=14394 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" "-" "-" "<host>" 4223
80.225.195.237 [17/Jul/2026:05:11:37 -0700] "GET /.env.example HTTP/1.1" 404 22 "-" port=16528 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" "-" "-" "<host>" 3883
80.225.195.237 [17/Jul/2026:05:11:39 -0700] "GET /.env.sample HTTP/1.1" 404 22 "-" port=18314 "Mo
show less
Web App Attack
2026-07-17 11:39:05
(11 hours ago)
Bot / scanning and/or hacking attempts: GET /client/.env HTTP/1.1, GET /docker-compose.dev.yml HTTP/ ...
show more
Bot / scanning and/or hacking attempts: GET /client/.env HTTP/1.1, GET /docker-compose.dev.yml HTTP/1.1, GET /server/.env HTTP/1.1, GET /.env.development.local HTTP/1.1, GET /public/.env HTTP/1.1, GET /frontend/.env HTTP/1.1, GET /private/.env HTTP/1.1, GET /var/.env HTTP/1.1, GET /web/.env HTTP/1.1, GET /docker-compose.yml HTTP/1.1, GET /docker-compose.override.yml HTTP/1.1, GET /.env.production.local HTTP/1.1, GET /docker-compose.yaml HTTP/1.1, GET /docker-compose.prod.yml HTTP/1.1, GET /api/.env HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 11:07:42
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 07:07:34.250296 2026] [security2:error] [pid 3921984:tid 3921984] [client 80.225.195.237:17602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ronelgas.com"] [uri "/private/.env"] [unique_id "aloM9iv79fISSZfdS8r7mwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 10:34:35
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 06:34:30.938280 2026] [security2:error] [pid 31545:tid 31545] [client 80.225.195.237:18146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hesterpark.braunfamily.info"] [uri "/.env"] [unique_id "aloFNj849E0S-YvcC_-_WQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
DocNetzwerk
2026-07-17 10:02:17
(12 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 80.225.195.237 (IN/India/-)
SQL Injection
🇫🇷
breubit
2026-07-17 09:04:26
(13 hours ago)
80.225.195.237 - - [17/Jul/2026:11:04:25 +0200] "GET /web/.env HTTP/1.1" 403 4467 "-" "Mozilla/5.0 ( ...
show more
80.225.195.237 - - [17/Jul/2026:11:04:25 +0200] "GET /web/.env HTTP/1.1" 403 4467 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:48:54
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:48:47.765212 2026] [security2:error] [pid 12713:tid 12805] [client 80.225.195.237:51888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.oftv.hdtv55.com"] [uri "/.env.test"] [unique_id "alnsbyE8n2VA5bNQf-AIxgAAAMU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:27:12
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:27:04.930271 2026] [security2:error] [pid 569:tid 569] [client 80.225.195.237:48942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theyoungstrategist.com"] [uri "/.env.development"] [unique_id "alnnWODh61WFg3_JwVZdpQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 07:58:38
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 80.225.195.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 03:58:30.882634 2026] [security2:error] [pid 6819:tid 6819] [client 80.225.195.237:41804] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.amazingfittings.amazinghydraulics.com"] [uri "/.env"] [unique_id "alngpl9_GAqFLDIoUTTSFQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack