🇨🇳
ThreatBook.io
2026-04-25 23:07:43
(4 months ago)
ThreatBook Intelligence: vpn_proxy,Dynamic IP more details on https://threatbook.io/ip/124.222.186.8 ...
show more
ThreatBook Intelligence: vpn_proxy,Dynamic IP more details on https://threatbook.io/ip/124.222.186.88
2026-04-25 08:22:08 /.env
2026-04-25 01:47:43 /.env
show less
Web App Attack
🇧🇪
voormedia
2026-04-23 23:24:48
(4 months ago)
Accessed trap at '/.env'
Web App Attack
🇪🇸
bohl-aiG5aef
2026-04-23 15:26:31
(4 months ago)
Suricata Alert [SID:2031502] ET INFO Request to Hidden Environment File - Inbound
Hacking
🇺🇸
TPI-Abuse
2026-04-23 01:10:01
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 21:09:56.022543 2026] [security2:error] [pid 2772769:tid 2772769] [client 124.222.186.88:61403] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.juncurryahn.com"] [uri "/.env"] [unique_id "aelxZI4FAYDyvyi07ycK7QAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-23 00:20:02
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 20:19:57.982309 2026] [security2:error] [pid 31958:tid 31958] [client 124.222.186.88:55109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rockitfish.com"] [uri "/.env"] [unique_id "aellrRyuoXdgPfw0EnxIXwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-04-22 20:21:12
(4 months ago)
Accessed trap at '/.env'
Web App Attack
🇩🇪
strxmpp
2026-04-21 23:10:30
(4 months ago)
124.222.186.88 - - [22/Apr/2026:01:10:28 +0200] "GET /.env HTTP/1.1" 404 3752 "-" "Mozilla/5.0 (Wind ...
show more
124.222.186.88 - - [22/Apr/2026:01:10:28 +0200] "GET /.env HTTP/1.1" 404 3752 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/535.24 (KHTML, like Gecko) Chrome/19.0.1055.1 Safari/535.24"
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-21 20:54:42
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 16:54:38.489024 2026] [security2:error] [pid 581081:tid 581081] [client 124.222.186.88:56720] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "utilis.net"] [uri "/.env"] [unique_id "aefkDkGOvaVm0fwoI_u8pgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-21 20:24:16
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 16:24:10.875498 2026] [security2:error] [pid 1611573:tid 1611573] [client 124.222.186.88:58969] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "infrared-heaters.us"] [uri "/.env"] [unique_id "aefc6iyxQYjPVG5raiMgWAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-21 16:43:28
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 12:43:22.431937 2026] [security2:error] [pid 399512:tid 399512] [client 124.222.186.88:64103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theproducers.com"] [uri "/.env"] [unique_id "aeepKnIj6piZaSk12kgxggAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
ThreatBook.io
2026-04-20 23:16:56
(4 months ago)
ThreatBook Intelligence: vpn_proxy,Dynamic IP more details on https://threatbook.io/ip/124.222.186.8 ...
show more
ThreatBook Intelligence: vpn_proxy,Dynamic IP more details on https://threatbook.io/ip/124.222.186.88
2026-04-20 04:10:01 /.env
show less
Web App Attack
🇺🇸
jsjdmediallc
2026-04-17 05:29:17
(4 months ago)
Auto-blocked: score 10 (threshold 10). Hits: 1. Flags: env-file. Paths: /.env
Bad Web Bot
Web App Attack
2026-04-16 10:05:35
(4 months ago)
124.222.186.88 - - [16/Apr/2026:18:05:34 +0800] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windo ...
show more
124.222.186.88 - - [16/Apr/2026:18:05:34 +0800] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/535.24 (KHTML, like Gecko) Chrome/19.0.1055.1 Safari/535.24"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 09:18:49
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 124.222.186.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 05:18:40.933722 2026] [security2:error] [pid 1615678:tid 1615729] [client 124.222.186.88:64303] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "booking.heworeblack.com"] [uri "/.env"] [unique_id "ad4GcC7X7Y47WXj7nW14fAAAAVU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-04-14 03:18:45
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.env
UA: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/535.24 (KHTML, like Gecko) Chrome/19.0.1055.1 Safari/535.24
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot