🇺🇸
JakoBian98
2026-09-22 17:10:22
(2 minutes ago)
graphiafinans.com: sir/kimlik bilgisi tarama path'i denendi: /.env.staging
Web App Attack
Hacking
🇳🇱
Site.eu
2026-09-22 17:09:44
(3 minutes ago)
Excessive 404/403 errors
Brute-Force
🇪🇸
elcruzado.es
2026-09-22 17:03:25
(9 minutes ago)
(mod_security) mod_security triggered on hostname [redacted] 87.192.41.15 (DE/Germany/-)
SQL Injection
🇫🇷
ELYAZ
2026-09-22 16:53:43
(19 minutes ago)
(y3) Failed access -byebye- from 87.192.41.15 (GB/United Kingdom/-): (CF_ENABLE)
Hacking
🇺🇸
TPI-Abuse
2026-09-22 16:45:31
(27 minutes ago)
(mod_security) mod_security (id:210492) triggered by 87.192.41.15 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 87.192.41.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:45:25.690376 2026] [security2:error] [pid 9911:tid 9911] [client 87.192.41.15:63724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "friedeprod.com"] [uri "/.env"] [unique_id "arKwpf3M1XYlxPOgUhlMTQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
arsonist
2026-09-22 15:40:54
(1 hour ago)
[fail2ban]
2026-09-22T15:40:54.123384+00:00 arson caddy[1890453]: {"level":"info","ts":1790091654.12 ...
show more
[fail2ban]
2026-09-22T15:40:54.123384+00:00 arson caddy[1890453]: {"level":"info","ts":1790091654.1233423,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"87.192.41.15","remote_port":"47880","client_ip":"87.192.41.15","proto":"HTTP/1.1","method":"GET","host":"furtress.tf","uri":"/.env","headers":{"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"furtress.tf","ech":false}},"bytes_read":0,"user_id":"","duration":0.000077405,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
Bad Web Bot
🇺🇸
CBJ
2026-09-22 15:32:46
(1 hour ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇵🇱
sefinek.net
2026-09-22 15:29:54
(1 hour ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /home/ubuntu/.config/gcloud/application_default_credentials.json | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
stdcout9090
2026-09-22 15:24:48
(1 hour ago)
AetherGuard WAF blocked: COMODO WAF: URL file extension is restricted by policy||management.aethergu ...
show more
AetherGuard WAF blocked: COMODO WAF: URL file extension is restricted by policy||management.aetherguard.xyz|F|2
Target: management.aetherguard.xyz/root/.config/gcloud/credentials.db
(51 attempts logged from this IP)
Payload / matched WAF rule data:
Matched by WAF:
.db
show less
Web App Attack
🇺🇸
copyyy
2026-09-22 15:11:30
(2 hours ago)
Repeated attempts to retrieve environment/configuration files.
Web App Attack
🇵🇱
Budyn
2026-09-22 15:08:24
(2 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: backup.astropot.tech | URI: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇨🇭
YF
2026-09-22 15:07:14
(2 hours ago)
WordPress config file probe
Web App Attack
🇺🇸
MatCat
2026-09-22 15:05:11
(2 hours ago)
Banned by fail2ban: apache-webprobe
Port Scan
Bad Web Bot
2026-09-22 14:48:34
(2 hours ago)
(caddyscan) Scanner path probe from 87.192.41.15 (IE/Ireland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 87.192.41.15 (IE/Ireland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 87.192.41.15 - - [22/Sep/2026:14:48:33 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 87.192.41.15 - - [22/Sep/2026:14:48:33 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 87.192.41.15 - - [22/Sep/2026:14:48:33 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 87.192.41.15 - - [22/Sep/2026:14:48:33 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 87.192.41.15 - - [22/Sep/2026:14:48:33 +0000] "GET /.env.dev HTTP/1.1"
show less
Port Scan
🇺🇸
Lea
2026-09-22 14:42:17
(2 hours ago)
Malicious web probe detected on bearstool.com: 87.192.41.15 - - [22/Sep/2026:10:42:17 -0400] "GET /. ...
show more
Malicious web probe detected on bearstool.com: 87.192.41.15 - - [22/Sep/2026:10:42:17 -0400] "GET /.env HTTP/1.1" 404 555 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
