|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-30.
|
Web App Attack
SSH
Hacking
|
|
🇺🇸
mnsf
|
|
Scanning/Probing (12)
|
Brute-Force
Web App Attack
|
|
🇺🇸
mw
|
|
GET /.env HTTP/1.1
|
Web App Attack
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: >3000 req/min op 2026-10-30
|
Web App Attack
SSH
Hacking
|
|
🇺🇸
infra-monitor
|
|
Automated ban via infra-monitor: mgmt-path-probe, suspicious-probe, wp-sensitive-paths, +2 more
|
Port Scan
Web App Attack
|
|
🇧🇷
radardatelecom
|
|
Blocked by Radar da Telecom firewall — abuseipdb
|
Bad Web Bot
Web App Attack
|
|
🇨🇭
Masterpiece
|
|
Web scanner probing for non-existent paths (wp-login, .env, xmlrpc and similar). 11 requests within one hour.
|
Web App Attack
|
|
🇵🇱
Budyn
|
|
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: staging.definitelynotahoneypot.top | URI: /.env.l ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: staging.definitelynotahoneypot.top | URI: /.env.local | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"162.220.232.121","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a52bc9eb6f5e8acf-SJC","Accept-Language":"en-US,en;q=0.9","Accept"
show less
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 162.220.232.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:11:44.492107 2026] [security2:error] [pid 14868:tid 14868] [client 162.220.232.121:3488 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.220.232.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:11:44.492107 2026] [security2:error] [pid 14868:tid 14868] [client 162.220.232.121:34888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kh.cpking.com"] [uri "/.env.production"] [unique_id "auTBwAkLjf0bNaoS_cmQEQAAAAo"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
IVski.com
|
|
IVski WAF | Sensitive file probe - looking for exposed .env.production
|
Hacking
Brute-Force
Web App Attack
|
|
🇬🇧
WebNiraj
|
|
(mod_security) mod_security (id:949110) triggered by 162.220.232.121 (US/United States/-): 5 in the last 3600 secs [SIGMA]
|
Brute-Force
|
|
🇿🇦
Megasurf
|
|
web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).
|
Web App Attack
|
|
🇫🇷
masterguru
|
|
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
|
Hacking
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 162.220.232.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:16:06.312316 2026] [security2:error] [pid 15702:tid 15702] [client 162.220.232.121:3571 ...
show more
(mod_security) mod_security (id:210492) triggered by 162.220.232.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:16:06.312316 2026] [security2:error] [pid 15702:tid 15702] [client 162.220.232.121:35712] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stardancertantra.com"] [uri "/.env.backup"] [unique_id "auSmpgkBNm6vvlWBaewkcwAAACs"], referer: https://www.google.com/search?q=stardancertantra.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇵🇱
Budyn
|
|
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: login.budyn.xyz | URI: /.env.production | UA: Moz ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: login.budyn.xyz | URI: /.env.production | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"162.220.232.121","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a52b04e4caed4f1b-SJC","Accept-Language":"en-US,en;q=0.9","Accept":"text\/html,a
show less
|
Bad Web Bot
Web App Attack
|
