🇷🇺
DZBOT
2026-05-22 05:38:41
(2 weeks ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
dtorrer
2026-05-22 04:58:43
(2 weeks ago)
General vulnerability scan.
Port Scan
🇺🇸
routerjockey
2026-05-22 01:11:37
(2 weeks ago)
[sensor1] Observed 103 TCP SYN probes in the past 6 hours [Top port 443/tcp(103x)]
Port Scan
🇩🇪
paissangroup
2026-05-21 23:22:30
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-21 22:01:52
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-20.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-21 21:01:48
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 17:01:43.965017 2026] [security2:error] [pid 32620:tid 32620] [client 91.239.78.126:58821] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "diegogamazo.com"] [uri "/.env"] [unique_id "ag9yt26G6eUbihgnW1y1_wAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 03:47:14
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 23:47:08.917810 2026] [security2:error] [pid 21543:tid 21543] [client 91.239.78.126:42925] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "delta-pizza.com"] [uri "/.env"] [unique_id "ag6APOh3WLYdGoqG-uA_pQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 02:54:47
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 22:54:43.674551 2026] [security2:error] [pid 22029:tid 22029] [client 91.239.78.126:40849] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "debradamico.com"] [uri "/.env"] [unique_id "ag5z80ZH2HvSIbXC-D4tPgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-05-21 02:33:20
(2 weeks ago)
108 requests with url.path *.env
Brute-Force
Bad Web Bot
2026-05-21 01:46:22
(2 weeks ago)
(caddyscan) Scanner path probe from 91.239.78.126 (UA/Ukraine/dedicated.vsys.host): 5 in the last 36 ...
show more
(caddyscan) Scanner path probe from 91.239.78.126 (UA/Ukraine/dedicated.vsys.host): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 91.239.78.126 - - [21/May/2026:01:46:18 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 91.239.78.126 - - [21/May/2026:01:46:18 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 91.239.78.126 - - [21/May/2026:01:46:18 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 91.239.78.126 - - [21/May/2026:01:46:18 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 91.239.78.126 - - [21/May/2026:01:46:19 +0000] "GET /.env.staging HTTP/1.1"
show less
Port Scan
🇩🇪
Skyrider
2026-05-21 01:29:24
(2 weeks ago)
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Window ...
show more
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env.local HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env.production HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env.development HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
91.239.78.126 - - [21/May/2026:03:29:24 +0200] "GET /.env.staging HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-21 00:27:38
(2 weeks ago)
Web vulnerability probing: /.env.staging
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:33:03
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.126 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:32:58.776969 2026] [security2:error] [pid 32641:tid 32641] [client 91.239.78.126:51959] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyberviews.club"] [uri "/.env"] [unique_id "ag3iOn2daIXPAFqUfZzQ6AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack