|
🇩🇪
london2038.com
|
|
Probing for exploits
176.116.0.2 - - [31/Oct/2026:13:51:20 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 M ...
show more
Probing for exploits
176.116.0.2 - - [31/Oct/2026:13:51:20 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
176.116.0.2 - - [31/Oct/2026:13:51:19 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
show less
|
Hacking
Web App Attack
|
|
🇬🇧
Aetherweb Ark
|
|
(mod_security) mod_security (id:949110) triggered by 176.116.0.2 (sercoy.com): N in the last X secs
|
Web App Attack
|
|
🇩🇪
kkw
|
|
[REDACTED] 176.116.0.2 - - [31/Oct/2026:11:05:03 +0100] "GET /.env HTTP/1.1" 302 4875 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile S ...
show more
[REDACTED] 176.116.0.2 - - [31/Oct/2026:11:05:03 +0100] "GET /.env HTTP/1.1" 302 4875 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
... (mode: searching http-sensitive-files)
show less
|
Bad Web Bot
Web App Attack
|
|
🇮🇩
securejdprop
|
|
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access.
|
Hacking
Web App Attack
|
|
🇮🇩
PENJAGA.AUM
|
|
176.116.0.2 - Attack: Possible XSS attack, js event handler
|
Web App Attack
SQL Injection
Spoofing
|
|
🇳🇱
Alt255
|
|
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 176.116.0.2 - - [31/Oct/2026:03:52:55 +0100] "GET /.env HTTP/1.1" 301 481 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT4 ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 176.116.0.2 - - [31/Oct/2026:03:52:55 +0100] "GET /.env HTTP/1.1" 301 481 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 176.116.0.2 (sercoy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 20:58:22.202646 2026] [security2:error] [pid 1111:tid 1111] [client 176.116.0.2:62170 ...
show more
(mod_security) mod_security (id:210492) triggered by 176.116.0.2 (sercoy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 20:58:22.202646 2026] [security2:error] [pid 1111:tid 1111] [client 176.116.0.2:62170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nnrentacar.com"] [uri "/.env"] [unique_id "auU9LkKuGsMBG1B9Fgm-lAAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
london2038.com
|
|
Probing for exploits
176.116.0.2 - - [31/Oct/2026:00:55:24 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 M ...
show more
Probing for exploits
176.116.0.2 - - [31/Oct/2026:00:55:24 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
176.116.0.2 - - [31/Oct/2026:00:55:24 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
show less
|
Hacking
Web App Attack
|
|
🇨🇭
SOC [GOLINE SA]
|
|
FortiGate detected brute force login attempt from IPv4 address 176.116.0.2
|
Brute-Force
SSH
|
|
🇨🇭
SOC [GOLINE SA]
|
|
FortiGate IPS: AndroxGh0st.Malware (severity high)
|
Hacking
|
|
🇺🇸
SX Communications
|
|
HTTP application-layer DoS / botnet traffic from 176.116.0.2: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
|
DDoS Attack
Bad Web Bot
Exploited Host
|
|
🇧🇪
voormedia
|
|
Accessed trap at '/.env'
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 176.116.0.2 (sercoy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 02:10:17.675186 2026] [security2:error] [pid 24503:tid 24503] [client 176.116.0.2:559 ...
show more
(mod_security) mod_security (id:210492) triggered by 176.116.0.2 (sercoy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 02:10:17.675186 2026] [security2:error] [pid 24503:tid 24503] [client 176.116.0.2:55916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mjaaforum.org"] [uri "/.env"] [unique_id "auQ0yU87dDi8K1Asl3cG_AAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
london2038.com
|
|
Probing for exploits
176.116.0.2 - - [30/Oct/2026:06:23:55 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 M ...
show more
Probing for exploits
176.116.0.2 - - [30/Oct/2026:06:23:55 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
176.116.0.2 - - [30/Oct/2026:06:23:55 +0100] "GET /.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
show less
|
Hacking
Web App Attack
|
|
🇩🇪
MusicLibrary
|
|
Attempted access to sensitive configuration files (.env, .git, etc.)
|
Bad Web Bot
Web App Attack
|