🇩🇪
SCHAPPY
2026-06-01 11:09:05
(2 days ago)
Malicious activity from IP detected: crowdsecurity/http-sensitive-files.
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-06-01 10:33:41
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 06:33:33.181014 2026] [security2:error] [pid 14846:tid 14846] [client 145.223.108.60:40822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drbolen.com"] [uri "/.env"] [unique_id "ah1f_c81_E6rvJVK4edsuQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-06-01 06:43:46
(2 days ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
NL/Netherlands/-
Web App Attack
🇫🇷
dynamix
2026-06-01 05:31:57
(2 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
Phenix Info
2026-06-01 05:29:28
(2 days ago)
SmallGuard.fr - Forbidden Ext.
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 02:53:33
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 22:53:25.904129 2026] [security2:error] [pid 20385:tid 20385] [client 145.223.108.60:59254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "steveyett.com"] [uri "/api/.env"] [unique_id "ahz0JaLvhMLAcKvqE5xqRgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 02:37:23
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 22:37:18.503685 2026] [security2:error] [pid 7732:tid 7770] [client 145.223.108.60:26950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nopicturesproductions.com"] [uri "/api/.env"] [unique_id "ahzwXiKq_i-FrRbJEDIKHAAAAVg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 01:27:44
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:27:39.534863 2026] [security2:error] [pid 22402:tid 22402] [client 145.223.108.60:37640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thegolfhole.com"] [uri "/dev/.env"] [unique_id "ahzgCy08F-gkvpGZ8IhBxwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 01:05:36
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:05:28.546538 2026] [security2:error] [pid 22291:tid 22291] [client 145.223.108.60:20344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "foxmm.com"] [uri "/.env"] [unique_id "ahza2Ig2spWEWwlXorzulQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 00:34:08
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 20:34:03.626434 2026] [security2:error] [pid 23222:tid 23222] [client 145.223.108.60:20716] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peacefulsteps.com"] [uri "/member/.env"] [unique_id "ahzTe-HJI3o97huj-DdJ3QAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-31 23:24:38
(2 days ago)
(caddyscan) Scanner path probe from 145.223.108.60 (ID/Indonesia/-): 5 in the last 3600 secs; Ports: ...
show more
(caddyscan) Scanner path probe from 145.223.108.60 (ID/Indonesia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 145.223.108.60 - - [31/May/2026:23:24:37 +0000] "GET /admin/.env HTTP/1.1"
[REDACTED] 200 2627 145.223.108.60 - - [31/May/2026:23:24:37 +0000] "GET /core/.env HTTP/1.1"
[REDACTED] 200 2627 145.223.108.60 - - [31/May/2026:23:24:37 +0000] "GET /backend/.env HTTP/1.1"
[REDACTED] 200 2627 145.223.108.60 - - [31/May/2026:23:24:37 +0000] "GET /app/.env HTTP/1.1"
[REDACTED] 200 2627 145.223.108.60 - - [31/May/2026:23:24:37 +0000] "GET /dev/.env HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-31 22:48:52
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 18:48:45.373354 2026] [security2:error] [pid 620:tid 620] [client 145.223.108.60:63378] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wendeeholtcamp.com"] [uri "/.env"] [unique_id "ahy6zX2fAjA0VQsp1W2zKQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jkhorvath.com
2026-05-31 21:58:07
(3 days ago)
Request for URL /member/.env
Phishing
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-05-31 21:50:06
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-05-31 21:43:24
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.223.108.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 17:43:21.287914 2026] [security2:error] [pid 18290:tid 18290] [client 145.223.108.60:36172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "markgiffin.com"] [uri "/app/.env"] [unique_id "ahyreUf6ZFJW-s8zxMmP2wAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack