🇨🇭
TheCoon
2026-06-16 20:00:01
(4 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
4server
2026-06-16 19:23:00
(4 days ago)
[TueJun1621:22:55.9800052026][security2:error][pid1469697:tid1469936][client161.118.171.111:0]ModSec ...
show more
[TueJun1621:22:55.9800052026][security2:error][pid1469697:tid1469936][client161.118.171.111:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"probuild.ch\"][uri\"/.env\"][unique_id\"ajGij-qVq2Y7RZgOAafs3wAAAQU\"]
show less
Hacking
Web App Attack
🇧🇷
Halux
2026-06-16 18:06:39
(4 days ago)
161.118.171.111 Probing protected path or service
Web App Attack
🇦🇺
2000cn.com.au
2026-06-16 17:37:56
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
2026-06-16 13:18:40
(5 days ago)
Web App Attack
🇧🇪
voormedia
2026-06-16 12:44:37
(5 days ago)
Accessed trap at '/.env'
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-15 03:43:22
(6 days ago)
[Mon Jun 15 13:43:22.218916 2026] [security2:error] [pid 63255] [client 161.118.171.111:50982] [clie ...
show more
[Mon Jun 15 13:43:22.218916 2026] [security2:error] [pid 63255] [client 161.118.171.111:50982] [client 161.118.171.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/.env"] [unique_id "ai902uB-lxxAWxLvnsSQqgAAABo"]
...
show less
Web App Attack
🇫🇷
✨
2026-06-15 00:09:13
(6 days ago)
Domain : stephenpeek.co.uk
Rule : env
2026-06-15 00:07:34 ***hidden-privacy*** GET /.env - 443 - 161 ...
show more
Domain : stephenpeek.co.uk
Rule : env
2026-06-15 00:07:34 ***hidden-privacy*** GET /.env - 443 - 161.118.171.111 HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 - www.stephenpeek.co.uk 404 0 2 1525 213 306 - -
show less
Hacking
SQL Injection
🇧🇪
cmbplf
2026-06-14 20:41:26
(6 days ago)
993 requests with url.path *.env
Brute-Force
Bad Web Bot
🇩🇪
sdos.es
2026-06-14 20:12:16
(6 days ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"
Web App Attack
🇭🇺
bcsaba
2026-06-14 16:58:09
(6 days ago)
Probing for .env file:
161.118.171.111 - - [14/Jun/2026:18:58:06 +0200] "GET /.env HTTP/1.1" 400 632 ...
show more
Probing for .env file:
161.118.171.111 - - [14/Jun/2026:18:58:06 +0200] "GET /.env HTTP/1.1" 400 632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0"
show less
Web App Attack
🇧🇪
voormedia
2026-06-14 16:52:02
(6 days ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:39:55
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:39:50.681068 2026] [security2:error] [pid 15834:tid 15834] [client 161.118.171.111:37564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.montepulciano.org"] [uri "/.env"] [unique_id "ai6vJpgIFhuxeV76gs0rTQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:22:53
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:22:45.393961 2026] [security2:error] [pid 5313:tid 5313] [client 161.118.171.111:57848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.madburylibrary.org"] [uri "/.env"] [unique_id "ai6rJaBSwUaj1mPryykUGQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:03:33
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 161.118.171.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:03:29.291771 2026] [security2:error] [pid 24524:tid 24524] [client 161.118.171.111:56886] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.killarneypool.org"] [uri "/.env"] [unique_id "ai6moR4oxm8yUhXjNud9HgAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack