🇫🇷
Dechavanne
2026-05-13 14:00:08
(3 weeks ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇬🇧
Smish
2026-05-13 13:50:51
(3 weeks ago)
HONEYPOT HIT --> Fail2ban time=1778680249 log=2026-05-13T14:50:49+01:00 ip=176.65.139.239 host=as210 ...
show more
HONEYPOT HIT --> Fail2ban time=1778680249 log=2026-05-13T14:50:49+01:00 ip=176.65.139.239 host=as210667.net method=GET uri="/.env" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ref="-" rid=7cc721a6297ac6eecea5bf752d98c0d2
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-13 13:35:03
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 176.65.139.239 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 176.65.139.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 09:34:55.539238 2026] [security2:error] [pid 18618:tid 18618] [client 176.65.139.239:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/.env"] [unique_id "agR9_691XR85FtDXwg9JxAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-05-13 13:17:03
(3 weeks ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇬🇧
SilverZippo
2026-05-13 13:14:45
(3 weeks ago)
Web App Attack
Web App Attack
🇺🇸
Matthew Ping
2026-05-13 13:00:02
(3 weeks ago)
ModSecurity rule 949110 triggered on dedicated4785. Web application attack blocked by CSF/LFD.
Web App Attack
Hacking
2026-05-13 12:59:47
(3 weeks ago)
176.65.139.239 - - [13/May/2026:12:59:46 +0000] "GET /.env HTTP/1.1" 404 6335 "-" "Mozilla/5.0 (Wind ...
show more
176.65.139.239 - - [13/May/2026:12:59:46 +0000] "GET /.env HTTP/1.1" 404 6335 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇰
ScamAware
2026-05-13 12:58:19
(3 weeks ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom.
show less
Web App Attack
🇺🇸
dtorrer
2026-05-13 12:56:11
(3 weeks ago)
General vulnerability scan.
Port Scan
🇺🇸
MPL
2026-05-13 12:55:04
(3 weeks ago)
tcp/443 (9 or more attempts)
Port Scan
🇺🇸
Starburst SysOp Team
2026-05-13 12:50:47
(3 weeks ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-stl2-14)
Hacking
Web App Attack
🇫🇷
Baking333
2026-05-13 12:49:18
(3 weeks ago)
[redacted] 176.65.139.239 - - [13/May/2026:13:48:02 +0100] "GET /.env HTTP/1.1" 302 1533 0/396002 "- ...
show more
[redacted] 176.65.139.239 - - [13/May/2026:13:48:02 +0100] "GET /.env HTTP/1.1" 302 1533 0/396002 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" [redacted] 176.65.139.239 - - [13/May/2026:13:49:17 +0100] "GET /.env HTTP/1.1" 302 5293 0/60959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-05-13 12:46:29
(3 weeks ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
TPI-Abuse
2026-05-13 12:41:47
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 176.65.139.239 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 176.65.139.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 08:41:43.864172 2026] [security2:error] [pid 29977:tid 29977] [client 176.65.139.239:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.upskirtcrazy.com"] [uri "/.env"] [unique_id "agRxhzkPbwTtKPthUI_qDwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dwmp
2026-05-13 12:40:40
(3 weeks ago)
Url probing: /.env/
Web App Attack