🇩🇪
Dominik Lysiak
2026-05-27 07:28:07
(1 week ago)
85.121.215.239 - - [27/May/2026:09:28:06 +0200] "GET /.aws/credentials HTTP/1.1" 301 162 "-" "Mozill ...
show more
85.121.215.239 - - [27/May/2026:09:28:06 +0200] "GET /.aws/credentials HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; U; Android 14; zh-CN; SM-S921B Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/131.0.0.0 MQQBrowser/14.5 Mobile Safari/537.36"
85.121.215.239 - - [27/May/2026:09:28:06 +0200] "GET /.env.staging HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) UBrowser/8.0.0.0 Chrome/120.0.0.0 Safari/537.36"
85.121.215.239 - - [27/May/2026:09:28:06 +0200] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
...
show less
Web App Attack
2026-05-27 07:24:18
(1 week ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
itsnixk
2026-05-27 07:20:45
(1 week ago)
(mod_security) mod_security (id:930130) triggered by 85.121.215.239 (RO/Romania/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:930130) triggered by 85.121.215.239 (RO/Romania/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed May 27 03:20:39.306205 2026] [security2:error] [pid 872857:tid 873350] [client 85.121.215.239:0] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".env" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/vault.env"] [unique_id "ahabR8R1bZyzY7Z85UqvdQAAAF8"]
show less
Port Scan
2026-05-27 06:24:26
(1 week ago)
"GET /.env HTTP/1.1"
Hacking
Web App Attack
🇺🇸
kosada.com
2026-05-27 06:01:54
(1 week ago)
Web vulnerability probing: /_next/build-manifest.json
Web App Attack
🇫🇷
ELYAZ
2026-05-27 03:57:35
(1 week ago)
(y3) Failed access -byebye- from 85.121.215.239 (RO/Romania/-): (CF_ENABLE)
Hacking
🇩🇪
LRob.fr
2026-05-27 03:00:10
(1 week ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇩🇪
EGP Abuse Dept
2026-05-27 02:27:50
(1 week ago)
Scanning for web/db/file exploits on www.defontein.eu
SQL Injection
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-05-27 01:29:37
(1 week ago)
Accessed trap at '/.git/config'
Web App Attack
🇨🇭
Origon
2026-05-26 22:47:05
(1 week ago)
http-sensitive-files - IP: 85.121.215.239 - time="2026-05-27T00:47:05+02:00" level=info msg="(555f6 ...
show more
http-sensitive-files - IP: 85.121.215.239 - time="2026-05-27T00:47:05+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 85.121.215.239 (RO/39347) : 4h ban on Ip 85.121.215.239" module=db
show less
Web App Attack
2026-05-26 22:14:18
(1 week ago)
Portscan: TCP/80 (5x), TCP/443 (3x)
Port Scan
2026-05-26 20:44:28
(1 week ago)
85.121.215.239 - - [26/May/2026:20:44:28 +0000] "GET /backend/.env HTTP/1.1" 404 6132 "-" "Mozilla/5 ...
show more
85.121.215.239 - - [26/May/2026:20:44:28 +0000] "GET /backend/.env HTTP/1.1" 404 6132 "-" "Mozilla/5.0 (Linux; U; Android 14; zh-CN; SM-S921B Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/131.0.0.0 MQQBrowser/14.5 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-05-26 20:40:51
(1 week ago)
Try to access /backend/.env
Web App Attack
🇩🇪
Hary74656
2026-05-26 20:12:35
(1 week ago)
[Tue May 26 22:12:16.653386 2026] [security2:error] [pid 176925:tid 177013] [client 85.121.215.239:4 ...
show more
[Tue May 26 22:12:16.653386 2026] [security2:error] [pid 176925:tid 177013] [client 85.121.215.239:44222] [client 85.121.215.239] ModSecurity: Access denied with code 403 (phase 2). String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.26th.eu"]
...
show less
Web App Attack
🇫🇷
Kimax
2026-05-26 19:14:03
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force