🇺🇸
ambor
2026-09-05 01:15:19
(1 hour ago)
L0ss Honeypot: Environment file access attempt. Path: /.env
Web App Attack
🇺🇸
RH5
2026-09-04 22:41:23
(3 hours ago)
Restricted URL probing (/.env) (UTC 2026-09-04 22:41)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 22:26:16
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 18:26:09.485465 2026] [security2:error] [pid 6032:tid 6032] [client 151.242.30.238:54888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jcpenterprise.com"] [uri "/.env"] [unique_id "aptFga3pVuqqOgqTtGZtfQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-04 21:45:03
(4 hours ago)
suspicious request in access.log
Web App Attack
🇳🇴
jad-abuse
2026-09-04 21:20:30
(4 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 21:16:07
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:16:00.413836 2026] [security2:error] [pid 3209:tid 3256] [client 151.242.30.238:49170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mwcecommerce.com"] [uri "/.env"] [unique_id "aps1EMLJBHTX2mjZlZLTdQAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
thesimonmanuel
2026-09-04 20:30:33
(5 hours ago)
151.242.30.238 - - [05/Sep/2026:02:00:32 +0530] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macin ...
show more
151.242.30.238 - - [05/Sep/2026:02:00:32 +0530] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 19:51:21
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 15:51:15.034935 2026] [security2:error] [pid 14513:tid 14513] [client 151.242.30.238:59811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pluscures.com"] [uri "/.env"] [unique_id "apshM2Y3XlJOhIQqU3YpZwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 18:31:44
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 14:31:38.830494 2026] [security2:error] [pid 10686:tid 10686] [client 151.242.30.238:50294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "proprocessor.com"] [uri "/.env"] [unique_id "apsOihePUd6f8WDxKNVEkgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-04 16:12:49
(10 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-02 23:13:08
(2 days ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 23:10:37
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 151.242.30.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:10:33.397268 2026] [security2:error] [pid 15198:tid 15198] [client 151.242.30.238:54716] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clowaterart.com"] [uri "/.env"] [unique_id "apis6fL-j-BrygR6VN9ZbgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BetterBotHunter
2026-09-01 22:31:19
(3 days ago)
Triggered honeypot (Better Bot Hunter 3)
Bad Web Bot
Web App Attack
🇺🇸
aks4226
2026-08-25 19:20:57
(1 week ago)
Attacking common web applications.
Web App Attack
🇱🇻
garmtech.com
2026-04-15 11:17:23
(4 months ago)
IP Address black-listed by anti-spam (blocked).
Email Spam
