🇬🇧
sc user
2026-11-15 06:43:13
UTC ·
(16 minutes ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇺🇸
TPI-Abuse
2026-11-15 05:53:52
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:53:46.064309 2026] [security2:error] [pid 17690:tid 17690] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:53:46.064309 2026] [security2:error] [pid 17690:tid 17690] [client 84.233.212.12:56993] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tevalaur.athome360.com"] [uri "/.env/.env.bak"] [unique_id "avlI6gS0gpXM4vKv0TULwQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 05:10:55
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:10:49.443679 2026] [security2:error] [pid 22491:tid 22514] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:10:49.443679 2026] [security2:error] [pid 22491:tid 22514] [client 84.233.212.12:61593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.moon.n5brg.com"] [uri "/.env/.env.bak"] [unique_id "avk-2TRI2g5fV1WaOcU7tQAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
netclix.gr
2026-11-15 04:41:35
UTC ·
(2 hours ago)
(security_scan) Sensitive File Scan Blocked 84.233.212.12 (US/United States/unn-84-233-212-12.datapacket.com)
Hacking
🇺🇸
TPI-Abuse
2026-11-15 04:22:24
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 23:22:16.437502 2026] [security2:error] [pid 24948:tid 24948] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 23:22:16.437502 2026] [security2:error] [pid 24948:tid 24948] [client 84.233.212.12:53406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tcjohnston.com"] [uri "/.env/.env.bak"] [unique_id "avkzeGm_bJrdVPdRYPeeagAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
srebrakowski.com
2026-11-15 03:03:46
UTC ·
(3 hours ago)
crowdsec/waf-detected-exploits
Brute-Force
🇪🇸
Juan Ramon Hernandez
2026-11-15 02:37:42
UTC ·
(4 hours ago)
Blocked by fail2ban on our web server (surpan.com) — Escáner: pidió rutas de ataque (wp-login, .env, phpmyadmin…)
Port Scan
Web App Attack
🇬🇧
andypiper
2026-11-15 02:01:14
UTC ·
(4 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇮🇹
Inartis
2026-11-15 01:13:46
UTC ·
(5 hours ago)
84.233.212.12 - - [15/Nov/2026:02:13:32 +0100] "GET /xmlrpc.php HTTP/1.1" 403 5793 "-" "python-httpx/0.28.1"
84.233.212.12 - - [15/Nov/2026:02:13:43 +0100] "GET /.env/.env.bak HTTP/1.1" 302 513 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK ...
show more
84.233.212.12 - - [15/Nov/2026:02:13:32 +0100] "GET /xmlrpc.php HTTP/1.1" 403 5793 "-" "python-httpx/0.28.1"
84.233.212.12 - - [15/Nov/2026:02:13:43 +0100] "GET /.env/.env.bak HTTP/1.1" 302 513 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
84.233.212.12 - - [15/Nov/2026:02:13:45 +0100] "GET /.env/.env.bak HTTP/1.1" 403 5578 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ams_sec_user
2026-11-15 01:05:18
UTC ·
(5 hours ago)
Automated requests against a hosted website: 3 requests between 00:00 and 00:59 UTC; 3 probes for exposed secrets/config files (/_profiler/phpinfo, /.env/.env.bak, /.aws/credentials). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-11-15 00:49:24
UTC ·
(6 hours ago)
Azure WAF blocked a request. Rule: 100200. Observed at: 2026-11-15T00:47:55.000Z.
Web App Attack
🇱🇻
GooddayGroup
2026-11-15 00:07:43
UTC ·
(6 hours ago)
Automated probing for sensitive configuration files and environment leaks.
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-15 00:06:50
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 19:06:42.050469 2026] [security2:error] [pid 28037:tid 28037] ...
show more
(mod_security) mod_security (id:210492) triggered by 84.233.212.12 (unn-84-233-212-12.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 19:06:42.050469 2026] [security2:error] [pid 28037:tid 28037] [client 84.233.212.12:59972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sthefany.aguasolar.com"] [uri "/.env/.env.bak"] [unique_id "avj3kgyiRdeO4GwEPdbAqwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
ma2yeah
2026-11-15 00:02:01
UTC ·
(6 hours ago)
84.233.212.12 - - [15/Nov/2026:09:01:50 +0900] "GET / HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" GeoIP: US/US
84.233.212.12 - - [15/Nov/2026:09:01:52 +090 ...
show more
84.233.212.12 - - [15/Nov/2026:09:01:50 +0900] "GET / HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" GeoIP: US/US
84.233.212.12 - - [15/Nov/2026:09:01:52 +0900] "GET /phpinfo.php HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" GeoIP: US/US
...
show less
Bad Web Bot
Web App Attack
🇨🇦
CentiDevOps
2026-11-14 23:57:16
UTC ·
(7 hours ago)
Web app scan: 35 requests in 4 s across 3 domains (301/404/444). Paths: /.env/.env.bak, /phpinfo.php, /_profiler/phpinfo (+1 more). Sample: 2026-11-14T23:57:16Z "GET /phpinfo.php" 444
Hacking
Web App Attack