🇩🇪
Progetto1
2026-06-13 15:35:02
(14 hours ago)
Detected via HAProxyScanner at 2026-06-13 15:35:02 UTC on destination port WEB (80/443). Repeated sc ...
show more
Detected via HAProxyScanner at 2026-06-13 15:35:02 UTC on destination port WEB (80/443). Repeated scan / connection.
show less
Port Scan
Hacking
Brute-Force
🇫🇮
mnazibo
2026-06-13 13:30:07
(16 hours ago)
Date: Jun 13 16:24:46 2026 EAT | Reported IP: 91.217.249.185 mod_security | id: 920350 | DE/username ...
show more
Date: Jun 13 16:24:46 2026 EAT | Reported IP: 91.217.249.185 mod_security | id: 920350 | DE/usernameab.my_domain/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Logs: ; Host header is a numeric IP address; Host header is a numeric IP address
show less
SQL Injection
Brute-Force
Bad Web Bot
🇺🇸
Starburst SysOp Team
2026-06-13 11:03:52
(19 hours ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-iad5-2)
Hacking
Bad Web Bot
2026-06-13 09:35:18
(20 hours ago)
DNS Compromise
DDoS Attack
🇩🇪
Herrminator
2026-06-13 00:15:36
(1 day ago)
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:29 +0200] "POST /.env HTTP/1.1" 503 190 "-" "Mo ...
show more
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:29 +0200] "POST /.env HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0" "-"
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:29 +0200] "GET /.env HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0" "-"
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:30 +0200] "GET /.env.prod HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0" "-"
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:30 +0200] "GET /.env.production HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0" "-"
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:30 +0200] "GET /redmine/.env HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0" "-"
85.215.157.225 91.217.249.185 - - [13/Jun/2026:02:15:31 +0200] "GET /__tests__/test-become/.env HTTP/1.1" 503
...
show less
Brute-Force
Web App Attack
🇩🇪
Hugopvigo
2026-06-12 21:55:46
(1 day ago)
"2026-06-12 21:55:46+00:00 91.217.249.185 IP con score alto (77) detectada en el log."
Brute-Force
SSH
🇺🇸
Starburst SysOp Team
2026-06-12 18:35:51
(1 day ago)
(mod_security-custom) mod_security (id:210492) triggered by 91.217.249.185 (DE/Germany/Hesse/Frankfu ...
show more
(mod_security-custom) mod_security (id:210492) triggered by 91.217.249.185 (DE/Germany/Hesse/Frankfurt am Main/-/[AS206092 SECFIREWALLAS]): 1 in the last 3600 secs (0-srv1)
show less
Hacking
🇮🇩
Burayot
2026-06-10 11:21:02
(3 days ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.217.249.185 (DE/Germany/-): 2 in ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.217.249.185 (DE/Germany/-): 2 in the last 3600 secs
show less
Web App Attack
🇩🇪
ut-addicted.com
2026-06-09 23:46:24
(4 days ago)
\[Wed Jun 10 01:46:22.528904 2026\] \[:error\] \[pid 20646:tid 139785653884672\] \[client 91.217.249 ...
show more
\[Wed Jun 10 01:46:22.528904 2026\] \[:error\] \[pid 20646:tid 139785653884672\] \[client 91.217.249.185:32863\] \[client 91.217.249.185\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/__tests__/test-become/.env"\] \[unique_id "aiilzl8P1GhGAMSE8pHTvAAAARg"\]
show less
Brute-Force
Web App Attack
🇩🇪
Hary74656
2026-06-09 23:18:18
(4 days ago)
[Wed Jun 10 01:18:15.727862 2026] [security2:error] [pid 197535:tid 197617] [client 91.217.249.185:2 ...
show more
[Wed Jun 10 01:18:15.727862 2026] [security2:error] [pid 197535:tid 197617] [client 91.217.249.185:20703] [client 91.217.249.185] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.env"] [unique_id "aiifN8wfPMr8FOZGMxBMqQAABCM"]
[Wed Jun 10 01:18:15.868126 2026] [security2:error] [pid 197535:tid 197616] [client 91.217.249.185:20703] [client 91.217.249.185] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/mods
...
show less
Web App Attack
🇩🇪
bescared
2026-06-09 20:49:27
(4 days ago)
F2B - Malicious activity detected. URL Probing. -8ff06ede-
Hacking
Bad Web Bot
Web App Attack
🇩🇪
psauxit
2026-06-07 07:21:00
(6 days ago)
Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ...
show more
Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping
show less
Web App Attack
Hacking
2026-06-06 21:44:40
(1 week ago)
Attac
Brute-Force
🇧🇪
cmbplf
2026-05-22 21:05:14
(3 weeks ago)
2.282 requests from abuseipdb.com blacklisted IP (1yr2mos1w)
Brute-Force
Bad Web Bot
🇳🇱
Site.eu
2026-05-22 02:24:27
(3 weeks ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH