🇳🇱
homeshowdomain.nl
2026-05-22 22:01:17
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-21.
show less
Web App Attack
SSH
Hacking
🇷🇺
DZBOT
2026-05-22 09:21:39
(2 weeks ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
2026-05-22 06:46:05
(2 weeks ago)
(caddyscan) Scanner path probe from 91.239.78.95 (UA/Ukraine/dedicated.vsys.host): 5 in the last 360 ...
show more
(caddyscan) Scanner path probe from 91.239.78.95 (UA/Ukraine/dedicated.vsys.host): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 91.239.78.95 - - [22/May/2026:06:45:59 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 91.239.78.95 - - [22/May/2026:06:46:00 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 91.239.78.95 - - [22/May/2026:06:46:00 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 91.239.78.95 - - [22/May/2026:06:46:00 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 91.239.78.95 - - [22/May/2026:06:46:00 +0000] "GET /.env.staging HTTP/1.1"
show less
Port Scan
🇺🇸
mnsf
2026-05-22 00:05:11
(2 weeks ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-21 22:01:45
(2 weeks ago)
Auto-ban: >3000 req/min op 2026-05-21
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-21 20:33:14
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 16:33:08.343507 2026] [security2:error] [pid 17629:tid 17629] [client 91.239.78.95:55203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.britanniapilates.com.systemcapacityoptimization.com"] [uri "/.env"] [unique_id "ag9sBDcNZHAWXZSGeOLCjAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 18:30:44
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 14:30:36.030250 2026] [security2:error] [pid 21693:tid 21693] [client 91.239.78.95:38369] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.billswilliams.com.bacpool.com"] [uri "/.env"] [unique_id "ag9PTO24VrMrXSy8o6ATzwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-05-21 16:40:08
(2 weeks ago)
432 requests with url.path *.env
Brute-Force
Bad Web Bot
🇫🇷
masterguru
2026-05-21 16:06:48
(2 weeks ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇬🇧
consul.to
2026-05-21 13:10:19
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 12:39:09
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 91.239.78.95 (dedicated.vsys.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 08:39:05.320238 2026] [security2:error] [pid 12616:tid 12616] [client 91.239.78.95:54331] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.andrewweigel.andrew.weigel.name"] [uri "/.env"] [unique_id "ag786XxQ0JwlvN8_zzVb4wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mashamal
2026-05-21 11:12:38
(2 weeks ago)
Vulnerability Probe
...
Web App Attack
🇫🇷
dynamix
2026-05-21 11:11:50
(2 weeks ago)
Multiple WAF Violations
Web App Attack
2026-05-21 11:07:37
(2 weeks ago)
Blocked: Reason='Suspicious traffic score=80 (review-based detection)'; Requests=81
Hacking
🇸🇪
vaia.cloud
2026-05-21 11:01:02
(2 weeks ago)
trying wp-login.php/xmlrpc.php 44 times in 1 minutes
Brute-Force
Web App Attack