🇳🇦
jacqueskruger
2026-11-04 19:40:20
UTC ·
(3 days ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 1 triggering events. Detections: crowdsecurity/vpatch-env-access. Latest evidence UTC: 2026-11-04T19:25:35Z. Evidence: inline WAF rejection of ex ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 1 triggering events. Detections: crowdsecurity/vpatch-env-access. Latest evidence UTC: 2026-11-04T19:25:35Z. Evidence: inline WAF rejection of exploit requests.
show less
Web App Attack
🇧🇷
radardatelecom
2026-11-04 16:53:04
UTC ·
(3 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-04 16:18:40
UTC ·
(3 days ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
JakoBian98
2026-11-04 15:48:42
UTC ·
(3 days ago)
graphiafinans.com: sir/kimlik bilgisi tarama path'i denendi: /.env
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-04 15:48:21
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:48:14.499902 2026] [security2:error] [pid 2862:tid 2862] [client 104.165.194.32:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:48:14.499902 2026] [security2:error] [pid 2862:tid 2862] [client 104.165.194.32:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.com"] [uri "/.env"] [unique_id "autTvjumVbr5xjiGndyqnAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 15:31:37
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:31:34.542906 2026] [security2:error] [pid 2159173:tid 2159213] [client 104.165.194.32:0] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:31:34.542906 2026] [security2:error] [pid 2159173:tid 2159213] [client 104.165.194.32:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindgardens.com"] [uri "/.env"] [unique_id "autP1gouv8eq87Y42oFg1wAAAYE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-04 14:33:33
UTC ·
(3 days ago)
[ssd5.kdns.gr] httpd-config-scan: sites=www.cancelletto.gr; logs=/var/log/httpd/domains/cancelletto.gr.log; samples=/.env
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 14:24:07
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 09:24:01.141588 2026] [security2:error] [pid 27195:tid 27195] [client 104.165.194.32:0] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 09:24:01.141588 2026] [security2:error] [pid 27195:tid 27195] [client 104.165.194.32:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yggdrasil.org"] [uri "/.env"] [unique_id "autAAePrzI4jitylW5dDXQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-04 14:15:48
UTC ·
(3 days ago)
Automated report: 1 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: /.env
Bad Web Bot
Web App Attack
🇩🇪
crypto i trust, hold i must
2026-11-04 14:01:31
UTC ·
(3 days ago)
Web scanner path: /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 13:35:33
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 08:35:27.440503 2026] [security2:error] [pid 5852:tid 5852] [client 104.165.194.32:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 104.165.194.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 08:35:27.440503 2026] [security2:error] [pid 5852:tid 5852] [client 104.165.194.32:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webfrog.ws"] [uri "/.env"] [unique_id "aus0n5b5eHVt1Fz5Pbem0wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-11-04 13:29:35
UTC ·
(3 days ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-04 13:29 UTC.
Bad Web Bot
Web App Attack
🇯🇵
warudora
2026-11-04 12:14:06
UTC ·
(3 days ago)
Automated Honeypot Trap: Attempted to access sensitive path '/.env' on a Flask server.
Hacking
Web App Attack
🇺🇸
swalluw
2026-11-04 12:13:43
UTC ·
(3 days ago)
Web vulnerability scanning: request for /.env (HTTP 404, GET) at 2026-11-04T12:13:43+00:00 - exploit probe, no legitimate use
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-11-04 11:21:49
UTC ·
(3 days ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-04 11:21 UTC.
Bad Web Bot
Web App Attack
