🇳🇱
Site.eu
2026-06-30 23:43:11
UTC ·
(4 months ago)
Excessive multi-domain requests
Brute-Force
🇮🇹
VHosting
2026-06-30 23:40:03
UTC ·
(4 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
2026-06-30 21:51:02
UTC ·
(4 months ago)
Bot / scanning and/or hacking attempts: GET /.env.development HTTP/1.1
Hacking
Web App Attack
🇨🇦
dispensight
2026-06-30 21:24:38
UTC ·
(4 months ago)
SecureLeaf CTI: credential/secret path probe; recon path (ngrok-tagged). 42 req against www.the4ssstvapes.ca (e.g. /.env.template). Defensive report; verified infra.
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 20:12:10
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 16:12:05.852890 2026] [security2:error] [pid 26489:tid 26489] [client 159.13.55.39:42654] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 16:12:05.852890 2026] [security2:error] [pid 26489:tid 26489] [client 159.13.55.39:42654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.furball.global"] [uri "/.env.backup"] [unique_id "akQjFbfJwnSukTXq4nOlxwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-06-30 19:05:57
UTC ·
(4 months ago)
HTTP vulnerability scanning
Web App Attack
2026-06-30 16:05:28
UTC ·
(4 months ago)
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-sensitive-files; Action=ban; Events=11; Hosts=incognet.io; Paths=/api/.env,/client/.env,/public/.env,/server/.env,/web/.env; Country=AU; ASN=31898 ORACLE-BMC-31898
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 15:29:32
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 11:29:28.589322 2026] [security2:error] [pid 12055:tid 12055] [client 159.13.55.39:43702] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 11:29:28.589322 2026] [security2:error] [pid 12055:tid 12055] [client 159.13.55.39:43702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "medusakenya.co.ke"] [uri "/.env.development"] [unique_id "akPg2IYcnG6YfGxvP4XjFgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 15:10:28
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 11:10:22.450591 2026] [security2:error] [pid 31116:tid 31116] [client 159.13.55.39:37152] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 11:10:22.450591 2026] [security2:error] [pid 31116:tid 31116] [client 159.13.55.39:37152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "manty.com"] [uri "/.env.local"] [unique_id "akPcXoolA3x5l5OkIG7_7AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Oakley
2026-06-30 14:57:04
UTC ·
(4 months ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇳🇴
Bots.go.to.hell
2026-06-30 13:45:33
UTC ·
(4 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-06-30 13:41:04
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 09:40:59.143379 2026] [security2:error] [pid 7440:tid 7440] [client 159.13.55.39:55074] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 09:40:59.143379 2026] [security2:error] [pid 7440:tid 7440] [client 159.13.55.39:55074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ilovecoffeegroup.com"] [uri "/.env"] [unique_id "akPHa0TAcmZ2jPME_a6IXgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-06-30 12:43:14
UTC ·
(4 months ago)
Probing websites for vulnerabilities
Web App Attack
SQL Injection
2026-06-30 12:21:02
UTC ·
(4 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-30 12:11:32
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 08:11:28.972542 2026] [security2:error] [pid 25957:tid 25957] [client 159.13.55.39:44792] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 159.13.55.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 08:11:28.972542 2026] [security2:error] [pid 25957:tid 25957] [client 159.13.55.39:44792] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cor-ex.com"] [uri "/.env.backup"] [unique_id "akOycGa-keaibsUZYk67WAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack