🇧🇪
cmbplf
2026-05-30 06:32:08
(5 days ago)
366 requests with url.path *.env
185 requests with url.path *config.json
129 requests with url.pa ...
show more
366 requests with url.path *.env
185 requests with url.path *config.json
129 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇺🇸
kosada.com
2026-05-30 05:58:39
(5 days ago)
Web vulnerability probing: /_next/build-manifest.json
Web App Attack
🇩🇪
Blexyel
2026-05-30 05:27:37
(5 days ago)
85.121.126.149 - - [30/May/2026:07:27:36 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 ...
show more
85.121.126.149 - - [30/May/2026:07:27:36 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
...
show less
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-05-30 05:25:12
(5 days ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
EDSL
2026-05-30 02:49:47
(5 days ago)
[mail.edsl.fr] Blocked by SysWarden Firewall (Web Attack)
Web App Attack
Hacking
Port Scan
🇯🇵
beon
2026-05-30 00:34:55
(5 days ago)
[DateTime=>2026-05-30T00:34:55Z to 2026-05-30T00:35:20Z (UTC)] , [HoneyPot_Hits=>29 times] , [HoneyP ...
show more
[DateTime=>2026-05-30T00:34:55Z to 2026-05-30T00:35:20Z (UTC)] , [HoneyPot_Hits=>29 times] , [HoneyPots=>/secrets.json, /config/application.properties, /.env.old, /config/secrets.yml, /backend/.env, /.env.bak and others] , [404targets=>/.aws/credentials, /.ssh/id_rsa, /settings.py, /key.json, /service-account.json, /credentials.json and others] , [total_Hits=>61 times] , [Keyword=>.well-known]
show less
Bad Web Bot
Web App Attack
Hacking
🇦🇹
SchiWaGoA
2026-05-29 17:30:02
(5 days ago)
This IP was detected by CrowdSec trigger from crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
gadix
2026-05-29 13:46:43
(5 days ago)
[29/May/2026:15:46:42.948719 +0200] ahmYwnTSlNvYKE0yjbGdJgAAAAg 85.121.126.149 59484 127.0.0.1 7080
...
show more
[29/May/2026:15:46:42.948719 +0200] ahmYwnTSlNvYKE0yjbGdJgAAAAg 85.121.126.149 59484 127.0.0.1 7080
[29/May/2026:15:46:42.959010 +0200] ahmYwnTSlNvYKE0yjbGdJwAAAAI 85.121.126.149 59492 127.0.0.1 7080
[29/May/2026:15:46:42.959273 +0200] ahmYwrrEHoy_usLiVCwwuQAAAE4 85.121.126.149 59518 127.0.0.1 7080
...
show less
Web App Attack
🇩🇪
patrisei
2026-05-29 13:20:44
(5 days ago)
You are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-probing
Port Scan
Web App Attack
🇩🇪
ger-stg-sifi1
2026-05-29 12:54:49
(5 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
Dominik Lysiak
2026-05-29 12:03:09
(6 days ago)
85.121.126.149 - - [29/May/2026:14:03:07 +0200] "GET /.aws/credentials HTTP/1.1" 200 9764 "-" "Mozil ...
show more
85.121.126.149 - - [29/May/2026:14:03:07 +0200] "GET /.aws/credentials HTTP/1.1" 200 9764 "-" "Mozilla/5.0 (Linux; Android 15; Pixel 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36"
85.121.126.149 - - [29/May/2026:14:03:08 +0200] "GET /.git/config HTTP/1.1" 200 9770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
85.121.126.149 - - [29/May/2026:14:03:09 +0200] "GET /.env.development HTTP/1.1" 200 9768 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0"
...
show less
Web App Attack
🇩🇪
dbmwebdesign
2026-05-29 10:35:11
(6 days ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
Charlesiv
2026-05-29 06:00:45
(6 days ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 9009 (M247 Europe SRL)
P ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 9009 (M247 Europe SRL)
Protocol: HTTP/1.1 (GET method)
Endpoint: /swagger.json
Timestamp: 2026-05-29T04:20:24Z
Ray ID: a032b4d54dce0b52
UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
ersei.net
2026-05-29 04:04:33
(6 days ago)
Brute force multiple 403s
Brute-Force
🇺🇸
TPI-Abuse
2026-05-29 04:02:56
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 85.121.126.149 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 85.121.126.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 00:02:49.565551 2026] [security2:error] [pid 1310:tid 1310] [client 85.121.126.149:42736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karenbernsteinlaw.net"] [uri "/.env.backup"] [unique_id "ahkP6V6oYtnmyuFzYfxv0QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack