|
🇺🇸
JustMeHere
|
|
[Thu Oct 08 22:04:36.051186 2026] [security2:error] [pid 1249:tid 1280] [client 157.230.12.173:51332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/acti ...
show more
[Thu Oct 08 22:04:36.051186 2026] [security2:error] [pid 1249:tid 1280] [client 157.230.12.173:51332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "test2.yorknation.com"] [uri "/.env"] [unique_id "ashLtJGlSUsbYuhhFIAblgAAAMM"]
...
show less
|
Web App Attack
|
|
🇨🇦
john doe
|
|
SentinelBot: Env File Hunting, Backup File Hunt (score: 73)
|
Bad Web Bot
|
|
🇳🇱
Alt255
|
|
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 157.230.12.173 - - [08/Oct/2026:09:19:21 +0200] "GET /.env HTTP/1.1" 301 605 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 157.230.12.173 - - [08/Oct/2026:09:19:21 +0200] "GET /.env HTTP/1.1" 301 605 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇧🇾
lns.bz
|
|
.env scanning [BY]
|
Web App Attack
|
|
🇳🇱
BlueWire Hosting
|
|
High-confidence malicious configuration/VCS probe
|
Web App Attack
|
|
🇺🇦
URAN Publishing Service
|
|
[08/Oct/2026:04:44:51 +0300] -- 157.230.12.173 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
|
Bad Web Bot
Web App Attack
|
|
🇬🇧
consul.to
|
|
Web attack/malicious scanning detected
|
Web App Attack
|
|
🇳🇱
Site.eu
|
|
Excessive multi-domain requests
|
Brute-Force
|
|
🇩🇪
Hary74656
|
|
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 157.230.12.173] [realclient 157.230.12.173] [07/Oct/2026:06:12:12 +0200] [vhost jellybox.aschi.at] 403 "GET /.env HTTP/1.1"
|
Web App Attack
|
|
🇩🇪
altenglaner
|
|
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
|
Hacking
Web App Attack
|
|
🇫🇷
masterguru
|
|
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
|
Hacking
Web App Attack
|
|
🇫🇷
arsonist
|
|
[fail2ban]
2026-10-06T01:55:41.112578+00:00 arson caddy[1712]: {"level":"info","ts":1791251741.1123793,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"157.230.12.173","remote_port":"48372","client_ip":"157.230.12.17 ...
show more
[fail2ban]
2026-10-06T01:55:41.112578+00:00 arson caddy[1712]: {"level":"info","ts":1791251741.1123793,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"157.230.12.173","remote_port":"48372","client_ip":"157.230.12.173","proto":"HTTP/1.1","method":"GET","host":"sync.arson.gg","uri":"/.env","headers":{"Connection":["keep-alive"],"Accept-Language":["en-US,en;q=0.5"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"sync.arson.gg","ech":false}},"bytes_read":0,"user_id":"","duration":0.000041899,"size":7,"status":418,"resp_headers":{"Content-Type":["text/plain; charset=
...
show less
|
Bad Web Bot
|
|
🇳🇱
thedreamer.nl
|
|
157.230.12.173 - - [06/Oct/2026:03:30:48 +0200] "GET /.env HTTP/1.1" 404 145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "US" "North Bergen" "40.79640" "-74.02030"
157.230.12.1 ...
show more
157.230.12.173 - - [06/Oct/2026:03:30:48 +0200] "GET /.env HTTP/1.1" 404 145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "US" "North Bergen" "40.79640" "-74.02030"
157.230.12.173 - - [06/Oct/2026:03:30:48 +0200] "GET /.env.backup HTTP/1.1" 404 145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "US" "North Bergen" "40.79640" "-74.02030"
157.230.12.173 - - [06/Oct/2026:03:30:48 +0200] "GET /.env.old HTTP/1.1" 404 145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "US" "North Bergen" "40.79640" "-74.02030"
157.230.12.173 - - [06/Oct/2026:03:30:48 +0200] "GET /.env.production HTTP/1.1" 404 145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "US" "North Bergen" "40.79640" "-74.02030"
...
show less
|
Hacking
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
IP matched detection query bad paths many.
|
Brute-Force
Web App Attack
|
|
🇫🇷
mail.avx.gr
|
|
(nginxENVSCAN) nginx environment-file scanner detected from 157.230.12.173 (US/United States/New Jersey/North Bergen/-)
|
Hacking
|
