🇳🇱
homeshowdomain.nl
2026-05-22 21:59:28
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-21.
show less
Web App Attack
SSH
Hacking
2026-05-22 08:18:08
(2 weeks ago)
(caddyscan) Scanner path probe from 91.239.78.67 (UA/Ukraine/dedicated.vsys.host): 5 in the last 360 ...
show more
(caddyscan) Scanner path probe from 91.239.78.67 (UA/Ukraine/dedicated.vsys.host): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 91.239.78.67 - - [22/May/2026:08:18:03 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 91.239.78.67 - - [22/May/2026:08:18:03 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 91.239.78.67 - - [22/May/2026:08:18:04 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 91.239.78.67 - - [22/May/2026:08:18:04 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 91.239.78.67 - - [22/May/2026:08:18:04 +0000] "GET /.env.staging HTTP/1.1"
show less
Port Scan
🇨🇭
4server
2026-05-22 06:52:33
(2 weeks ago)
[FriMay2208:52:27.4472302026][security2:error][pid3701042:tid3701199][client91.239.78.67:0]ModSecuri ...
show more
[FriMay2208:52:27.4472302026][security2:error][pid3701042:tid3701199][client91.239.78.67:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"turismo-marocco-lugano.ch\"][uri\"/.env\"][unique_id\"ag_9K7-LJJpJSKlqSLENhAAAABE\"]
show less
Hacking
Web App Attack
🇳🇴
Bots.go.to.hell
2026-05-22 05:37:06
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-05-22 04:36:22
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 00:36:16.752256 2026] [security2:error] [pid 17172:tid 17177] [client 91.239.78.67:59493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trident-environmental.com"] [uri "/.env"] [unique_id "ag_dQI-FU3f6fr0Ly6liPAAAAMI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 03:33:16
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 23:33:12.673109 2026] [security2:error] [pid 13426:tid 13426] [client 91.239.78.67:41219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tradesecretintrust.com"] [uri "/.env"] [unique_id "ag_OeLftNRBfq4I2W26gLQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-22 03:06:33
(2 weeks ago)
Blocked: Reason='Suspicious traffic score=80 (review-based detection)'; Requests=25
Hacking
🇭🇺
bcsaba
2026-05-22 02:36:24
(2 weeks ago)
Probing for .env file:
91.239.78.67 - - [22/May/2026:04:36:22 +0200] "GET /.env HTTP/1.1" 400 230 "- ...
show more
Probing for .env file:
91.239.78.67 - - [22/May/2026:04:36:22 +0200] "GET /.env HTTP/1.1" 400 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 02:23:38
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 22:23:32.954070 2026] [security2:error] [pid 26363:tid 26363] [client 91.239.78.67:36589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tortoisehosting.com"] [uri "/.env"] [unique_id "ag--JN4PIWFYBFDvcm5bNQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-05-22 01:09:50
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-21 21:59:10
(2 weeks ago)
Auto-ban: >3000 req/min op 2026-05-21
Web App Attack
SSH
Hacking
🇺🇸
infra-monitor
2026-05-21 20:00:05
(2 weeks ago)
Automated ban via infra-monitor: mgmt-path-probe, suspicious-probe, crowdsecurity/http-probing, +1 m ...
show more
Automated ban via infra-monitor: mgmt-path-probe, suspicious-probe, crowdsecurity/http-probing, +1 more
show less
Port Scan
Web App Attack
🇩🇪
FeG Deutschland
2026-05-21 14:11:24
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 11:37:16
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 07:37:10.261928 2026] [security2:error] [pid 8946:tid 8946] [client 91.239.78.67:53715] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.10bestrestaurants.com"] [uri "/.env.local"] [unique_id "ag7uZl67QCJY0zj4j9EPSQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 11:03:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.67 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 07:03:24.759847 2026] [security2:error] [pid 11818:tid 11834] [client 91.239.78.67:35085] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teritemme.com"] [uri "/.env"] [unique_id "ag7mfNrJb45eBpMQ66ZidAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack