🇩🇪
IVski.com
2026-10-20 02:18:25
(2 days ago)
IVski WAF | Webshell probe detected - requesting common script extensions
Hacking
Brute-Force
Web App Attack
2026-10-18 21:51:38
(4 days ago)
"GET /.env HTTP/1.1"
Hacking
Web App Attack
🇮🇩
sockominfo
2026-10-18 13:00:09
(4 days ago)
Active Response: IP 160.179.159.94 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Re ...
show more
Active Response: IP 160.179.159.94 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇨🇭
lufi
2026-10-18 12:24:37
(4 days ago)
2026-10-18T14:24:36+02:00 lufischer04 ids442 2026-10-18 14:24:36 160.179.159.94: blacklistedPath: /. ...
show more
2026-10-18T14:24:36+02:00 lufischer04 ids442 2026-10-18 14:24:36 160.179.159.94: blacklistedPath: /.env
...
show less
Web Spam
Brute-Force
Hacking
Web App Attack
2026-10-18 12:23:55
(4 days ago)
160.179.159.94 - - [18/Oct/2026:12:23:54 +0000] "GET /.env HTTP/1.1" 404 7913 "-" "Mozilla/5.0 (X11; ...
show more
160.179.159.94 - - [18/Oct/2026:12:23:54 +0000] "GET /.env HTTP/1.1" 404 7913 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:34:49
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:34:46.116880 2026] [security2:error] [pid 10757:tid 10757] [client 160.179.159.94:62552] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "renjunews.com"] [uri "/.env"] [unique_id "atSu1nLJ-K8Bv5_u6UIrawAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:14:14
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:14:08.983853 2026] [security2:error] [pid 13471:tid 13471] [client 160.179.159.94:56294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dmasoftlab.com"] [uri "/.env"] [unique_id "atSqABO9LbnPVkaPtfuySgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rayulcifer
2026-10-18 10:36:37
(4 days ago)
160.179.159.94 - - [18/Oct/2026:05:36:34 -0500] "GET /.env HTTP/1.1" 403 6803 "-" "Mozilla/5.0 (X11; ...
show more
160.179.159.94 - - [18/Oct/2026:05:36:34 -0500] "GET /.env HTTP/1.1" 403 6803 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
🇹🇼
ashiyasayo
2026-10-18 10:30:00
(4 days ago)
Detected env file scanning attempt, androxgh0st scanning traffic detection.
Web App Attack
🇫🇷
Batz
2026-10-18 09:25:42
(4 days ago)
Automated Web Bot hunting for hidden .env / AI API Credentials
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:13:13
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:13:06.192996 2026] [security2:error] [pid 30968:tid 30968] [client 160.179.159.94:62622] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apsni.net"] [uri "/.env"] [unique_id "atSNovbaISlZsHC5L0sUFwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
lid3rc
2026-10-18 08:58:11
(4 days ago)
Hiányzó Accept-Language fejléc
Web App Attack
2026-10-18 08:57:34
(4 days ago)
[ssd5.kdns.gr] httpd-config-scan: sites=homeburger.gr; logs=/var/log/httpd/domains/homeburger.gr.log ...
show more
[ssd5.kdns.gr] httpd-config-scan: sites=homeburger.gr; logs=/var/log/httpd/domains/homeburger.gr.log; samples=/.env | fast_lane=true kernel_at=2026-10-18T08:57:17+00:00 | requests=1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:20:36
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 160.179.159.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:20:31.053108 2026] [security2:error] [pid 17900:tid 17900] [client 160.179.159.94:60261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web87.dnchosting.com"] [uri "/.env"] [unique_id "atRzP1h4wByR2LCAo37ntwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 07:15:02
(4 days ago)
suspicious request in access.log
Web App Attack