🇺🇸
francelink.fr
2026-11-13 00:05:22
UTC ·
(1 hour ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-12T03:27:52.000Z.
Web App Attack
🇩🇪
raph
2026-11-12 18:34:46
UTC ·
(7 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
1cyb3rpunk
2026-11-12 16:26:13
UTC ·
(9 hours ago)
Honeypot interaction [EXPLOIT]: php_webshell_probe on /add.php. MITRE: T1204 (User Execution). UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36. Observed on sectrace.org honeypot surface — automated scan ...
show more
Honeypot interaction [EXPLOIT]: php_webshell_probe on /add.php. MITRE: T1204 (User Execution). UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36. Observed on sectrace.org honeypot surface — automated scanner/attacker activity.
show less
Exploited Host
Hacking
🇺🇸
Sushant Mahanty
2026-11-12 16:17:37
UTC ·
(9 hours ago)
99.69.17.69 - - [12/Nov/2026:11:17:20 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
99.69.17.69 - - [12/Nov/2026:11:17:24 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Moz ...
show more
99.69.17.69 - - [12/Nov/2026:11:17:20 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
99.69.17.69 - - [12/Nov/2026:11:17:24 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
99.69.17.69 - - [12/Nov/2026:11:17:36 -0500] "GET /.env.bak HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-11-12 15:12:10
UTC ·
(10 hours ago)
[Thu Nov 12 09:47:34.056296 2026] [:error] [pid 3297207:tid 140068480055040] [client 99.69.17.69:48070] [client 99.69.17.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/o ...
show more
[Thu Nov 12 09:47:34.056296 2026] [:error] [pid 3297207:tid 140068480055040] [client 99.69.17.69:48070] [client 99.69.17.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.26.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "actys.ims.forth.gr"] [uri "/backup/db.sql"] [unique_id "avVvFrFL3ZOPU0Rf2LlYWQAAAU8"]
[Thu Nov 12 09:47:34.231675 2026] [:error] [pid 3297207:tid 140068674938624] [client 99.69.17.69:48070] [client 99.69.17.69] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.26.0"] [tag "anomaly-evalua
...
show less
Hacking
Web App Attack
🇵🇱
strefapi_com
2026-11-12 07:33:51
UTC ·
(18 hours ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-11-12 06:45:05
UTC ·
(18 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
francelink.fr
2026-11-12 01:45:25
UTC ·
(23 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-12T01:44:40.000Z.
Web App Attack
🇬🇧
consul.to
2026-11-12 01:44:24
UTC ·
(23 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-11-11 22:09:41
UTC ·
(1 day ago)
Multiple, malicious web requests detected
Port Scan
Hacking
🇲🇾
Rizzy
2026-11-11 21:54:29
UTC ·
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
todix
2026-11-11 21:32:26
UTC ·
(1 day ago)
"GET /.env HTTP/1.1" 403 6308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131"
Web App Attack
🇳🇱
Savvii
2026-11-11 21:25:24
UTC ·
(1 day ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 19:59:41
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 99.69.17.69 (99-69-17-69.lightspeed.rlghnc.sbcglobal.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:59:33.291828 2026] [security2:error] [pid 16058:t ...
show more
(mod_security) mod_security (id:210492) triggered by 99.69.17.69 (99-69-17-69.lightspeed.rlghnc.sbcglobal.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:59:33.291828 2026] [security2:error] [pid 16058:tid 16058] [client 99.69.17.69:59922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "christineaholtz.com"] [uri "/.env"] [unique_id "avTJJcFsOrxJiA6gYGz-rQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-11 19:48:40
UTC ·
(1 day ago)
Multiple WAF Violations
Web App Attack
