🇫🇷
service Informatique
2026-10-28 04:00:37
(15 hours ago)
GET /.env
Web App Attack
🇳🇱
BlueWire Hosting
2026-10-28 02:31:33
(16 hours ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇧🇪
boxed-it
2026-10-28 00:26:36
(18 hours ago)
GET /.env (Tarpitted for 8h45m51s, wasted 1.8MB)
Web App Attack
🇬🇧
AvonleaConsulting
2026-10-27 23:58:29
(19 hours ago)
Attempts to probe web pages for vulnerable PHP or other applications
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-27 22:59:33
(20 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-26.
Web App Attack
SSH
Hacking
🇬🇧
AvonleaConsulting
2026-10-27 21:01:04
(22 hours ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 18:38:28
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:38:25.232765 2026] [security2:error] [pid 21486:tid 21486] [client 187.40.235.161:62734] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:38:25.232765 2026] [security2:error] [pid 21486:tid 21486] [client 187.40.235.161:62734] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "celebritybikinigossip.com"] [uri "/.env"] [unique_id "auDvoZgngUPwxVYjJqesGgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-10-27 18:00:47
(1 day ago)
.env scanning [BY]
Web App Attack
🇬🇧
consul.to
2026-10-27 15:53:18
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇧🇪
boxed-it
2026-10-27 15:40:33
(1 day ago)
GET /.env (Tarpitted for 3h52m8s, wasted 815.27kB)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 14:39:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 10:39:11.860857 2026] [security2:error] [pid 17333:tid 17333] [client 187.40.235.161:45266] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 10:39:11.860857 2026] [security2:error] [pid 17333:tid 17333] [client 187.40.235.161:45266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cartiologyfilms.com"] [uri "/.env"] [unique_id "auC3j-CvkY_llxVKXxaZjwAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-27 13:32:48
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [python-requests/2.32.4] from 187.40.235.161 (US/United States/-): 5 in the last 300 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 187.40.235.161 - - [27/Oct/2026:14 ...
show more
(apache-useragents) Failed apache-useragents trigger with match [python-requests/2.32.4] from 187.40.235.161 (US/United States/-): 5 in the last 300 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 187.40.235.161 - - [27/Oct/2026:14:32:33 +0100] "GET /.env HTTP/1.1" 403 442 "-" "python-requests/2.32.4"
187.40.235.161 - - [27/Oct/2026:14:32:33 +0100] "GET /.env HTTP/1.1" 403 442 "-" "python-requests/2.32.4"
187.40.235.161 - - [27/Oct/2026:14:32:32 +0100] "GET /.env HTTP/1.1" 403 442 "-" "python-requests/2.32.4"
187.40.235.161 - - [27/Oct/2026:14:32:45 +0100] "GET /.env HTTP/1.1" 403 442 "-" "python-requests/2.32.4"
187.40.235.161 - - [27/Oct/2026:14:32:44 +0100] "GET /.env HTTP/1.1" 403 442 "-" "python-requests/2.32.4"
show less
Port Scan
🇳🇱
Alt255
2026-10-27 13:03:01
(1 day ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 187.40.235.161 - - [27/Oct/2026:14:02:43 +0100] "GET /.env HTTP/1.1" 200 10440 "-" "python-requests/2.32.4"
...
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-27 12:04:43
(1 day ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 2 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 12:04:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 08:04:10.995230 2026] [security2:error] [pid 10310:tid 10310] [client 187.40.235.161:28228] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 08:04:10.995230 2026] [security2:error] [pid 10310:tid 10310] [client 187.40.235.161:28228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "carterindustries.net"] [uri "/.env"] [unique_id "auCTOjdcXT6CSoENzv8zAQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
