🇸🇮
administrator
2026-10-22 22:11:21
(3 hours ago)
2026-10-21 21:20:06,817 fail2ban.actions [1053]: NOTICE [apache-fakegooglebot] Ban 52.128.24 ...
show more
2026-10-21 21:20:06,817 fail2ban.actions [1053]: NOTICE [apache-fakegooglebot] Ban 52.128.241.108
2026-10-21 21:20:06,817 fail2ban.actions [1053]: NOTICE [apache-fakegooglebot] Ban 52.128.241.108
2026-10-21 21:20:06,817 fail2ban.actions [1053]: NOTICE [apache-fakegooglebot] Ban 52.128.241.108
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇺🇸
AEITS
2026-10-22 09:14:56
(16 hours ago)
Fail2Ban eMail
Port Scan
🇳🇴
cyruz
2026-10-22 06:03:37
(19 hours ago)
Email login Brute force
Hacking
Brute-Force
🇩🇪
LRob
2026-10-22 05:12:03
(20 hours ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT ...
show more
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
show less
Bad Web Bot
🇳🇱
EGP Abuse Dept
2026-10-22 02:18:08
(23 hours ago)
Unsolicited connection to port 465
Port Scan
Hacking
🇩🇪
NewGastroline
2026-10-22 01:29:18
(1 day ago)
Malicious request blocked by CrowdSec on gastro-prod1.boreus.de
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-21 22:00:14
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-20.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-21 18:01:01
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 52.128.241.108 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 52.128.241.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 14:00:48.082567 2026] [security2:error] [pid 15076:tid 15076] [client 52.128.241.108:48237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.accu-tuner.com"] [uri "/.env"] [unique_id "atj90GLrL0kquCghpW42tQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-21 11:43:44
(1 day ago)
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 52.128.241.108 - - [21/Oct/2026:13:43:31 +0200] "GET /.env HTTP/1.1" 404 7867 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇮🇹
zenmorro
2026-10-21 09:01:53
(1 day ago)
Honeypot hit (proxmox:8006) — scanner-path: /.env. Automated report from honeypot infrastructure
Port Scan
Web App Attack
🇺🇸
SX Communications
2026-10-21 08:42:10
(1 day ago)
HTTP application-layer DoS / botnet traffic from 52.128.241.108: repeated high-cost dynamic page and ...
show more
HTTP application-layer DoS / botnet traffic from 52.128.241.108: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇵🇱
Budyn
2026-10-21 03:13:44
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: prometheus.goblinpot.site | URI: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:37:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 52.128.241.108 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 52.128.241.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:37:43.642396 2026] [security2:error] [pid 25193:tid 25221] [client 52.128.241.108:45043] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.agriclean.net"] [uri "/.env.local"] [unique_id "atgld5PyY-Rwoz6tcc0K6wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
adnscom.com
2026-10-21 02:27:04
(1 day ago)
IPS trigger: dovecot scanning/attack
Brute-Force
Hacking
🇩🇪
lolyay
2026-10-21 02:16:10
(1 day ago)
52.128.241.108 - - [21/Oct/2026:02:16:07 +0000] "GET /.env HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Windows ...
show more
52.128.241.108 - - [21/Oct/2026:02:16:07 +0000] "GET /.env HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
52.128.241.108 - - [21/Oct/2026:02:16:09 +0000] "GET /.env.local HTTP/1.1" 200 4 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Web App Attack
Bad Web Bot