🇮🇩
zam
2026-07-14 21:35:53
(21 minutes ago)
103.141.60.42 - - [14/Jul/2026:21:35:07 +0000] "GET /.env HTTP/1.1" 404 81186
103.141.60.42 - - [14/ ...
show more
103.141.60.42 - - [14/Jul/2026:21:35:07 +0000] "GET /.env HTTP/1.1" 404 81186
103.141.60.42 - - [14/Jul/2026:21:35:10 +0000] "GET /.env HTTP/1.1" 404 81186
103.141.60.42 - - [14/Jul/2026:21:35:14 +0000] "GET /sman5malang.sch.id/.env HTTP/1.1" 404 81186
103.141.60.42 - - [14/Jul/2026:21:35:18 +0000] "GET /sman5malang.sch.id/.env HTTP/1.1" 404 81186
103.141.60.42 - - [14/Jul/2026:21:35:24 +0000] "GET /vendor/.env HTTP/1.1" 404 81186
{"log":"103.141.60.42 - - [14/Jul/2026:21:35:28 +0000] "GET /vendor/.env HTTP/1.1" 404 81
show less
Web App Attack
🇩🇪
roxyapi
2026-07-14 21:06:48
(51 minutes ago)
Honeypot: automated vulnerability scan / web app attack. Last probe: GET /beamdeal.com/.env
Web App Attack
Bad Web Bot
🇩🇰
ScamAware
2026-07-14 18:52:26
(3 hours ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 13. Unique request paths counted internally: 5. Cloudflare action: block. Cloudflare source: firewallCustom.
show less
Web App Attack
🇵🇾
armandosaucedo.me
2026-07-14 18:11:13
(3 hours ago)
Threat Intelligence via ARMTI, Web Attack: GET /.env
Web App Attack
🇺🇸
antlac1
2026-07-14 13:18:32
(8 hours ago)
crowdsecurity/CVE-2017-9841
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 11:38:40
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:38:35.780451 2026] [security2:error] [pid 3381410:tid 3381410] [client 103.141.60.42:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.colonybet.com"] [uri "/.env"] [unique_id "alYfu_rpi2zwaa8ne2MZ6QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-14 09:45:39
(12 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 09:38:27
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 05:38:19.719226 2026] [security2:error] [pid 7079:tid 7079] [client 103.141.60.42:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.top-brand.us"] [uri "/.env"] [unique_id "alYDixRgVyucc8gHr81vwAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ArturShelby
2026-07-14 08:40:23
(13 hours ago)
Critical file access: /.env
Web App Attack
2026-07-14 07:18:19
(14 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇩🇪
conseilgouz
2026-07-14 06:29:26
(15 hours ago)
ave-17 : Block hidden directories=>/.env(/)
Hacking
🇺🇸
slay3r9903
2026-07-14 05:35:44
(16 hours ago)
IP address blocked by Cloudflare security rules due to suspicious activity and security violations.
Hacking
Bad Web Bot
🇨🇦
Mediashaker
2026-07-14 02:43:05
(19 hours ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 103.141.60.42 (AU/Austra ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 103.141.60.42 (AU/Australia/-)
show less
Port Scan
🇬🇧
Apache
2026-07-14 01:34:10
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (AU/Australia/-): 5 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 103.141.60.42 (AU/Australia/-): 5 in the last 300 secs
show less
Brute-Force
Web App Attack
🇺🇸
helios.live
2026-07-13 22:31:26
(23 hours ago)
2026/07/13 22:31:18 [error] 285320#285320: *1675188 access forbidden by rule, client: 103.141.60.42, ...
show more
2026/07/13 22:31:18 [error] 285320#285320: *1675188 access forbidden by rule, client: 103.141.60.42, server: kocervpn.com, request: "GET /.env HTTP/1.1", host: "kocervpn.com"
2026/07/13 22:31:20 [error] 285320#285320: *1675188 access forbidden by rule, client: 103.141.60.42, server: kocervpn.com, request: "GET /.env HTTP/1.1", host: "kocervpn.com"
2026/07/13 22:31:22 [error] 285320#285320: *1675188 access forbidden by rule, client: 103.141.60.42, server: kocervpn.com, request: "GET /kocervpn.com/.env HTTP/1.1", host: "kocervpn.com"
2026/07/13 22:31:23 [error] 285320#285320: *1675188 access forbidden by rule, client: 103.141.60.42, server: kocervpn.com, request: "GET /kocervpn.com/.env HTTP/1.1", host: "kocervpn.com"
2026/07/13 22:31:25 [error] 285320#285320: *1675063 access forbidden by rule, client: 103.141.60.42, server: kocervpn.com, request: "GET /vendor/.env HTTP/1.1", host: "kocervpn.com"
...
show less
Web App Attack