🇸🇪
nekopavel
2026-07-11 10:42:49
(2 hours ago)
163.176.137.114 - - [11/Jul/2026:12:41:48 +0200]"GET /.env.dev HTTP/1.1" 200 4153"-" pavel.gg "Mozil ...
show more
163.176.137.114 - - [11/Jul/2026:12:41:48 +0200]"GET /.env.dev HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)""0.000" "-""S\xC3\xA3o Paulo" "BR"
163.176.137.114 - - [11/Jul/2026:12:41:49 +0200]"GET /.env.prod HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)""0.000" "-""S\xC3\xA3o Paulo" "BR"
163.176.137.114 - - [11/Jul/2026:12:41:49 +0200]"GET /.env.test HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)""0.000" "-""S\xC3\xA3o Paulo" "BR"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
expandmade.com
2026-07-11 04:16:23
(9 hours ago)
trolling for installation vulnerabilities [11/Jul/2026:04:16:23 "GET /.env.production"]
Web App Attack
🇩🇪
LRob
2026-07-11 02:46:43
(10 hours ago)
CrowdSec: crowdsecurity/http-sensitive-files | req: ["/.env","/.env.local","/.env.development","/.en ...
show more
CrowdSec: crowdsecurity/http-sensitive-files | req: ["/.env","/.env.local","/.env.development","/.env.dev","/.env.prod"] | UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"]
show less
Hacking
🇫🇮
6kilowatti
2026-07-11 02:18:06
(11 hours ago)
163.176.137.114 - - [11/Jul/2026:05:18:05 +0300] "GET /.env.development.local HTTP/1.1" 302 444 "-" ...
show more
163.176.137.114 - - [11/Jul/2026:05:18:05 +0300] "GET /.env.development.local HTTP/1.1" 302 444 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"
...
show less
Web App Attack
🇺🇸
Starburst SysOp Team
2026-07-11 00:02:40
(13 hours ago)
(mod_security-custom) mod_security (id:210492) triggered by 163.176.137.114 (BR/Brazil/São Paulo/São ...
show more
(mod_security-custom) mod_security (id:210492) triggered by 163.176.137.114 (BR/Brazil/São Paulo/São Paulo/-/[AS31898 ORACLE-BMC-31898]): 1 in the last 3600 secs (0-srv1)
show less
Hacking
🇩🇪
FeG Deutschland
2026-07-10 23:46:08
(13 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇳🇱
e.fierstra
2026-07-10 21:52:34
(15 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-07-10 21:50:20
(15 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
tsZero
2026-07-10 17:50:33
(19 hours ago)
Scan example: path=/.env status=200
Hacking
2026-07-10 13:44:08
(23 hours ago)
(caddyscan) Scanner path probe from 163.176.137.114 (BR/Brazil/-): 5 in the last 3600 secs; Ports: * ...
show more
(caddyscan) Scanner path probe from 163.176.137.114 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 163.176.137.114 - - [10/Jul/2026:13:44:05 +0000] "GET /.env.test HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [10/Jul/2026:13:44:05 +0000] "GET /.env.staging HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [10/Jul/2026:13:44:05 +0000] "GET /.env.backup HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [10/Jul/2026:13:44:06 +0000] "GET /.env.save HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [10/Jul/2026:13:44:06 +0000] "GET /.env.old HTTP/1.1"
show less
Port Scan
🇰🇷
doll.gl
2026-07-10 13:31:48
(1 day ago)
CrowdSec: Ip 163.176.137.114 performed 'crowdsecurity/http-sensitive-files' (5 events over 4.9169452 ...
show more
CrowdSec: Ip 163.176.137.114 performed 'crowdsecurity/http-sensitive-files' (5 events over 4.916945261s) at 2026-07-10 13:31:47.298282695 +0000 UTC (scenario: crowdsecurity/http-sensitive-files)
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-07-10 13:30:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 163.176.137.114 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 163.176.137.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 09:30:09.727900 2026] [security2:error] [pid 2811460:tid 2811460] [client 163.176.137.114:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.dentguyvt.com"] [uri "/.env"] [unique_id "alDz4TjzlaveJSCel_0AGgAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jcbriar
2026-07-10 08:27:36
(1 day ago)
Searching for vulnerable scripts
Hacking
Web App Attack
🇦🇺
nzhost.co.nz
2026-07-10 00:52:13
(1 day ago)
$f2bV_matches
Hacking
Brute-Force
2026-07-09 21:51:01
(1 day ago)
(caddyscan) Scanner path probe from 163.176.137.114 (BR/Brazil/-): 5 in the last 3600 secs; Ports: * ...
show more
(caddyscan) Scanner path probe from 163.176.137.114 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 163.176.137.114 - - [09/Jul/2026:21:50:55 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [09/Jul/2026:21:50:56 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [09/Jul/2026:21:50:56 +0000] "GET /.env.production HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [09/Jul/2026:21:50:57 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 163.176.137.114 - - [09/Jul/2026:21:50:57 +0000] "GET /.env.dev HTTP/1.1"
show less
Port Scan