🇬🇧
Smish
2026-10-14 10:15:58
(5 days ago)
HONEYPOT HIT --> Fail2ban time=1791972958 log=2026-10-14T11:15:58+01:00 ip=147.90.165.78 host=dal-ul ...
show more
HONEYPOT HIT --> Fail2ban time=1791972958 log=2026-10-14T11:15:58+01:00 ip=147.90.165.78 host=dal-ult-02-game.bya.ac method=GET uri="/.env" status=404 ua="Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ref="-" rid=7b8bd407521b8c001e97c079e5420d8b
show less
Web App Attack
🇬🇧
consul.to
2026-10-14 10:12:12
(5 days ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
Alt255
2026-10-14 09:20:58
(5 days ago)
[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 147.90.165.78 - - [14/Oct/2026:11:20:52 +0200] "GET /.env HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
...
show less
Bad Web Bot
Web App Attack
🇨🇦
Sakusen
2026-10-14 08:26:52
(5 days ago)
Automated web attack: 7 reqs, 4 paths probed, 2 returned 404; probed: 2 .php, 1 .env, 1 admin
Hacking
Web App Attack
🇬🇧
Smish
2026-10-14 07:48:44
(5 days ago)
HONEYPOT HIT --> Fail2ban time=1791964122 log=2026-10-14T08:48:42+01:00 ip=147.90.165.78 host=bytean ...
show more
HONEYPOT HIT --> Fail2ban time=1791964122 log=2026-10-14T08:48:42+01:00 ip=147.90.165.78 host=byteania.10g.tpa2.bya.ac method=GET uri="/.env" status=404 ua="Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ref="-" rid=0786279d1f7fd8c22e58c00ba4b96eb6
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 06:57:11
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 02:57:06.372666 2026] [security2:error] [pid 3248:tid 3248] [client 147.90.165.78:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.perl-photo.com"] [uri "/.env"] [unique_id "as8nwqQoOoikrkMKId95zwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:29:35
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:29:31.545679 2026] [security2:error] [pid 19558:tid 19558] [client 147.90.165.78:63463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bigcoins.com"] [uri "/.env"] [unique_id "as8TO-u8rGwbpPehkfQLyQAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Smish
2026-10-14 04:42:48
(5 days ago)
HONEYPOT HIT --> Fail2ban time=1791952967 log=2026-10-14T05:42:47+01:00 ip=147.90.165.78 host=cluste ...
show more
HONEYPOT HIT --> Fail2ban time=1791952967 log=2026-10-14T05:42:47+01:00 ip=147.90.165.78 host=clusternode2.bya.ac method=GET uri="/.env" status=404 ua="Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ref="-" rid=0f9ad52d53a9910e6ba5ede48fd242a6
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:44:39
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:44:35.681738 2026] [security2:error] [pid 16708:tid 16726] [client 147.90.165.78:54323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danielkerr.com"] [uri "/.env"] [unique_id "as7sk3ETDk4Zztr1J6mAXgAAAFA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
convos
2026-10-14 02:41:26
(5 days ago)
HONEYPOT .env probe on hq.it-solutionsusa.com
Port Scan
Web App Attack
🇨🇦
Sakusen
2026-10-14 02:28:02
(5 days ago)
Automated web attack: 7 reqs, 4 paths probed, 2 returned 404; probed: 2 .php, 1 .env, 1 admin
Hacking
Web App Attack
🇺🇸
ambor
2026-10-14 01:04:54
(5 days ago)
Honeypot access: Environment file access attempt. Path: /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:05:11
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.165.78 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:05:04.792218 2026] [security2:error] [pid 13412:tid 13412] [client 147.90.165.78:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "email.thectegroup.net"] [uri "/.env"] [unique_id "as6rEFfza4ciyRSTe-XFgQAAADs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-13 21:32:23
(6 days ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 147 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 147.90.165.78 - - [13/Oct/2026:23:32:21 +0200] "GET /.env HTTP/1.1" 301 491 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
...
show less
Bad Web Bot
Web App Attack
