π«π·
Baking333
2026-10-13 19:14:04
(40 minutes ago)
[redacted] 143.244.45.230 - - [13/Oct/2026:20:14:02 +0100] "GET /.env HTTP/1.1" 302 1522 0/107068 "- ...
show more
[redacted] 143.244.45.230 - - [13/Oct/2026:20:14:02 +0100] "GET /.env HTTP/1.1" 302 1522 0/107068 "-" "-" 80 [redacted] 143.244.45.230 - - [13/Oct/2026:20:14:02 +0100] "GET /.[redacted] HTTP/1.1" 302 1522 0/103305 "-" "-" 80
show less
Bad Web Bot
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-13 10:15:45
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:15:38.344130 2026] [security2:error] [pid 12427:tid 12427] [client 143.244.45.230:49694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "freightmotivity.com"] [uri "/.env"] [unique_id "as4Eytjji738GZMD7XCPGQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-13 09:44:15
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:44:09.336620 2026] [security2:error] [pid 8935:tid 8935] [client 143.244.45.230:60125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flyingdodopublications.com"] [uri "/.env"] [unique_id "as39aTCXvFW4-zaRh-HA9wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π©πͺ
hchristo
2026-10-13 09:24:27
(10 hours ago)
[Tue Oct 13 11:24:25.141919 2026] [authz_core:error] [pid 45112:tid 45503] [client 143.244.45.230:63 ...
show more
[Tue Oct 13 11:24:25.141919 2026] [authz_core:error] [pid 45112:tid 45503] [client 143.244.45.230:63459] AH01630: client denied by server configuration: /var/www/kd1103/htdocs/.env.save
[Tue Oct 13 11:24:25.142314 2026] [authz_core:error] [pid 45112:tid 45460] [client 143.244.45.230:63455] AH01630: client denied by server configuration: /var/www/kd1103/htdocs/.env.old
[Tue Oct 13 11:24:25.143495 2026] [authz_core:error] [pid 45112:tid 45467] [client 143.244.45.230:63454] AH01630: client denied by server configuration: /var/www/kd1103/htdocs/.env.bak
[Tue Oct 13 11:24:27.674232 2026] [authz_core:error] [pid 45112:tid 45504] [client 143.244.45.230:63455] AH01630: client denied by server configuration: /var/www/kd1103/htdocs/.env~
[Tue Oct 13 11:24:27.674510 2026] [authz_core:error] [pid 45112:tid 45467] [client 143.244.45.230:63453] AH01630: client denied by server configuration: /var/www/kd1103/htdocs/.env.bak~
...
show less
Brute-Force
πΊπΈ
TPI-Abuse
2026-10-13 09:20:14
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:20:10.938075 2026] [security2:error] [pid 5295:tid 5295] [client 143.244.45.230:64808] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fireflypov.com"] [uri "/.env.bak"] [unique_id "as33yl_1Y0eyIXQOxlwoXwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-13 08:50:57
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:50:53.853194 2026] [security2:error] [pid 8461:tid 8461] [client 143.244.45.230:60827] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fccemetery.org"] [uri "/.env"] [unique_id "as3w7aDWxFBWyXCJbNQhyQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π³π΄
jad-abuse
2026-10-13 08:25:57
(11 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, source_backup, admin_tools, credential_file, ssh_keys, db_dump, aws_creds, cgi_probe. Observed by 1 sensor(s); 369 hits.
show less
Hacking
Brute-Force
Web App Attack
π³π±
Brict IT
2026-10-13 07:59:23
(11 hours ago)
Bad Web Bot
Web App Attack
πΉπ·
eryilmaz
2026-10-13 07:46:05
(12 hours ago)
Automated attack blocked by eryilmaz WAF/defense engine (level 2, source: siem_correlation, path: /)
Web App Attack
Hacking
πΊπΈ
TPI-Abuse
2026-10-13 07:45:48
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.c ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.45.230 (unn-143-244-45-230.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 03:45:43.489871 2026] [security2:error] [pid 13270:tid 13270] [client 143.244.45.230:53087] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "esendeniz.net"] [uri "/.env"] [unique_id "as3hpxMaTddcqSGiH6YXPAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
π³π±
Site.eu
2026-10-13 07:41:55
(12 hours ago)
Excessive multi-domain requests
Brute-Force
π¨π
zynex
2026-10-13 07:25:50
(12 hours ago)
URL Probing: /index.php
Web App Attack
π³π±
Savvii
2026-10-13 07:21:33
(12 hours ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
π©πͺ
MusicLibrary
2026-10-13 07:21:14
(12 hours ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
πΉπ·
eryilmaz
2026-10-13 07:15:35
(12 hours ago)
Automated attack blocked by eryilmaz WAF/defense engine (level 1, source: auto, path: /.env.php)
Web App Attack
Hacking