🇧🇾
lns.bz
2026-09-05 06:43:33
(2 hours ago)
.env scanning [BY]
Web App Attack
🇳🇱
JCB
2026-09-04 21:36:00
(12 hours ago)
146.148.44.16 - - [04/Sep/2026:11:17:29 +0300] "GET /.env.prod HTTP/1.1" 403 239 "-" "crusader-worke ...
show more
146.148.44.16 - - [04/Sep/2026:11:17:29 +0300] "GET /.env.prod HTTP/1.1" 403 239 "-" "crusader-worker/1.0"
146.148.44.16 - - [04/Sep/2026:11:17:29 +0300] "GET /.env.dev HTTP/1.1" 403 239 "-" "crusader-worker/1.0"
...
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-04 14:04:15
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:04:10.745537 2026] [security2:error] [pid 22535:tid 22535] [client 146.148.44.16:52670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthdps.com"] [uri "/.env.dev"] [unique_id "aprP2rK1iI7sCSiibggb0AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:40:37
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:40:33.435703 2026] [security2:error] [pid 8088:tid 8088] [client 146.148.44.16:51100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flyingwithstan.stansco.com"] [uri "/.env.save"] [unique_id "aprKUdQilCwBRm4YuUFGjQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:17:37
(20 hours ago)
(mod_security) mod_security (id:210730) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:17:34.149979 2026] [security2:error] [pid 29100:tid 29100] [client 146.148.44.16:40932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||surveyiowa.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "surveyiowa.com"] [uri "/storage/logs/laravel.log"] [unique_id "aprE7lu2O42T1M4riM4OgQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 12:51:44
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 08:51:33.220173 2026] [security2:error] [pid 31751:tid 31751] [client 146.148.44.16:58454] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelmoorefield.com"] [uri "/.env.local"] [unique_id "apq-1TYQN0yP_2menrsmYwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
UnixPrime
2026-09-04 12:39:52
(20 hours ago)
146.148.44.16 - - [04/Sep/2026:14:39:51 +0200] "GET /.env.local HTTP/1.1" 404 146 "-" "crusader-work ...
show more
146.148.44.16 - - [04/Sep/2026:14:39:51 +0200] "GET /.env.local HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
146.148.44.16 - - [04/Sep/2026:14:39:51 +0200] "GET /.env HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇮🇪
AutosOnShow
2026-09-04 12:35:07
(21 hours ago)
blocked for webapp attack | path requested: /.env | seen at 2026-09-04 12:34:54.775 |
Web App Attack
🇵🇱
srebrakowski.com
2026-09-04 12:14:53
(21 hours ago)
crowdsec/waf-detected-exploits
Brute-Force
🇲🇾
Rizzy
2026-09-04 11:28:04
(22 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇨🇭
zynex
2026-09-04 11:18:48
(22 hours ago)
URL Probing: /.env
Web App Attack
🇫🇷
masterguru
2026-09-04 11:08:28
(22 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-195)
show less
Hacking
🇺🇸
mnsf
2026-09-04 11:05:30
(22 hours ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:53:02
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:52:56.939705 2026] [security2:error] [pid 1832:tid 1832] [client 146.148.44.16:49364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mx10.itimetable21.com"] [uri "/wp-config.php.swp"] [unique_id "apqjCFzjBo43TwWZf0bgxgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 09:59:32
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 146.148.44.16 (16.44.148.146.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 05:59:27.267755 2026] [security2:error] [pid 28055:tid 28055] [client 146.148.44.16:58932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.alphazeta.net"] [uri "/.env.local"] [unique_id "apqWfzwWx4I2AOydc1IbCwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack