2026-10-13 22:36:14
(3 days ago)
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web s ...
show more
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
show less
Web App Attack
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-10-13 21:59:47
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-12.
show less
Web App Attack
SSH
Hacking
🇳🇱
Alt255
2026-10-13 17:48:55
(4 days ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 103 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 103.174.104.76 - - \[13/Oct/2026:19:48:50 +0200\] "GET /mysql/.env HTTP/1.1" 301 5574 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 16:38:08
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 12:38:01.921331 2026] [security2:error] [pid 20211:tid 20295] [client 103.174.104.76:59672] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oceanstatecollision.com"] [uri "/mysql/.env"] [unique_id "as5eafWwVABDIAs9uG9WswAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 15:07:56
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 11:07:52.703493 2026] [security2:error] [pid 24136:tid 24136] [client 103.174.104.76:37146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nothotmail.org"] [uri "/.env2"] [unique_id "as5JSMD0wOvCPWg37g0ytwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 14:44:29
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 10:44:25.104507 2026] [security2:error] [pid 15463:tid 15463] [client 103.174.104.76:49585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "normteslaa.com"] [uri "/mysql/.env"] [unique_id "as5DyS6LjQgHhHEvXCUl5wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:48:19
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:48:16.139303 2026] [security2:error] [pid 11078:tid 11078] [client 103.174.104.76:50569] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "needtoorderprinting.com"] [uri "/.env2"] [unique_id "as4agH_HhoraIXlrIiCagQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 10:47:50
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:47:43.896469 2026] [security2:error] [pid 17152:tid 17152] [client 103.174.104.76:50949] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "naplesdogcenter.com"] [uri "/.env2"] [unique_id "as4MTxn-StSSTOT5W77TNQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-13 08:27:07
(4 days ago)
Bot / scanning and/or hacking attempts: GET /.env2 HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 06:54:03
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 02:53:55.880367 2026] [security2:error] [pid 3764:tid 3764] [client 103.174.104.76:59652] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "monopolimusic.com"] [uri "/mysql/.env"] [unique_id "as3Vg1kk47F_1kSoAMieAAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-13 06:42:36
(4 days ago)
[ns41.kdns.gr] httpd-config-scan: sites=www.monastiria.gr; logs=/var/log/httpd/domains/monastiria.gr ...
show more
[ns41.kdns.gr] httpd-config-scan: sites=www.monastiria.gr; logs=/var/log/httpd/domains/monastiria.gr.log; samples=/mysql/.env
show less
Hacking
Web App Attack
🇺🇸
OceanTreasure
2026-10-13 04:31:37
(4 days ago)
tcp/443; Environment configuration file exposure attempt: "GET /.env2" @ 2026-10-13T04:31:37Z [proxy ...
show more
tcp/443; Environment configuration file exposure attempt: "GET /.env2" @ 2026-10-13T04:31:37Z [proxy]
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 03:58:44
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 23:58:41.072120 2026] [security2:error] [pid 14582:tid 14582] [client 103.174.104.76:42350] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelkivisto.com"] [uri "/mysql/.env"] [unique_id "as2scSQZz0xBsTLrNMVA3AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
lakered
2026-10-13 01:01:27
(4 days ago)
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configu ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configuration file search | Evidence: Verified-Bot-JA4-Match (t13d131100), Trusted-JA4-Signature (t13d131100), High-Criminality-Signature (ja4h:e0264a3100bfa47758587ac4545f447d - Ratio:0.93), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:Unknown, Uptime:0m)
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-13 00:38:49
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.174.104.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 20:38:42.428232 2026] [security2:error] [pid 29541:tid 29541] [client 103.174.104.76:52858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "masterfulenlighteningfreestudies.org"] [uri "/.env2"] [unique_id "as19kvHb6kXKuxeL41vxjAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack