🇬🇧
openstrike.co.uk
2026-10-09 05:15:19
(3 weeks ago)
5 attacks on env grabbing URLs, site downloads (type 2), Laravel URLs, PHP URLs, VC URLs:
GET /.env HTTP/1.1
GET /demo HTTP/1.1
GET /_ignition/execute-solution HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.git/confi ...
show more
5 attacks on env grabbing URLs, site downloads (type 2), Laravel URLs, PHP URLs, VC URLs:
GET /.env HTTP/1.1
GET /demo HTTP/1.1
GET /_ignition/execute-solution HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.git/config HTTP/1.1
show less
Hacking
Web App Attack
🇧🇷
radardatelecom
2026-10-08 22:27:13
(3 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-08 21:59:47
(3 weeks ago)
Auto-ban: >3000 req/min op 2026-10-08
Web App Attack
SSH
Hacking
🇫🇷
COMAITE
2026-10-08 16:06:41
(3 weeks ago)
Common web attack from 162.243.194.78.
Web App Attack
🇧🇪
cmbplf
2026-10-08 15:55:30
(3 weeks ago)
223 requests with url.path /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
188 requests with url.path */.git/config
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-08 15:14:32
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 11:14:29.541036 2026] [security2:error] [pid 9265:tid 9265] [client 162.243.194.78:6348] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 11:14:29.541036 2026] [security2:error] [pid 9265:tid 9265] [client 162.243.194.78:6348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "czarcrestwesties.com"] [uri "/.env"] [unique_id "asezVRglk3XGb5efThaqlgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-10-08 15:06:15
(3 weeks ago)
IPS detection: PHPUnit.Eval-stdin.PHP.Remote.Code.Execution
Hacking
2026-10-08 14:40:30
(3 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 14:34:42
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:34:37.403620 2026] [security2:error] [pid 11909:tid 11909] [client 162.243.194.78:61972] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:34:37.403620 2026] [security2:error] [pid 11909:tid 11909] [client 162.243.194.78:61972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cygnetsilks.com"] [uri "/.env"] [unique_id "asep_dUesEjiqWJ-N5YrawAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇬
Stoyko Stoykov
2026-10-08 14:18:05
(3 weeks ago)
162.243.194.78 - - [08/Oct/2026:17:18:05 +0300] "GET /.env HTTP/2.0" 404 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
Hacking
Web App Attack
🇫🇷
Quarks Solutions
2026-10-08 14:17:29
(3 weeks ago)
crowdsecurity/appsec-vpatch
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 14:17:08
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:17:02.376851 2026] [security2:error] [pid 20125:tid 20125] [client 162.243.194.78:20516] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.243.194.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:17:02.376851 2026] [security2:error] [pid 20125:tid 20125] [client 162.243.194.78:20516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyberviews.club"] [uri "/.env"] [unique_id "asel3kOQ307LzCKsEnCuqAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-08 14:15:31
(3 weeks ago)
[ThuOct0816:15:26.9847662026][security2:error][pid1206741:tid1206754][client162.243.194.78:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"9607 ...
show more
[ThuOct0816:15:26.9847662026][security2:error][pid1206741:tid1206754][client162.243.194.78:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"cybertelgroup.com\"][uri\"/.env\"][unique_id\"aselfrkEHm1a3AFbBXFXfwAAAUo\"]
show less
Hacking
Web App Attack
🇫🇷
GoodOldTOS
2026-10-08 14:09:29
(3 weeks ago)
Highly suspect IP
Hacking
Web App Attack
🇺🇸
mnsf
2026-10-08 14:05:22
(3 weeks ago)
Too many Status 40X (14)
Brute-Force
Web App Attack
