🇬🇧
sc user
2026-05-16 04:56:58
UTC ·
(5 months ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-05-14 19:21:25
UTC ·
(6 months ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-05-13 11:51:43
UTC ·
(6 months ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇮🇳
evicky2002
2026-05-13 07:18:32
UTC ·
(6 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇬🇧
sc user
2026-05-12 04:42:39
UTC ·
(6 months ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
openstrike.co.uk
2026-05-11 05:13:17
UTC ·
(6 months ago)
8 attacks on env grabbing URLs, password grabbing URLs, config grabbing URLs (type 2):
GET /app/.env HTTP/1.1
GET /.aws/credentials HTTP/1.1
GET /secrets.json HTTP/1.1
Hacking
🇮🇩
Burayot
2026-05-10 21:51:56
UTC ·
(6 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 188.166.12.135 (NL/Netherlands/-): 1 in the last 3600 secs
Web App Attack
🇩🇪
Hary74656
2026-05-10 20:37:41
UTC ·
(6 months ago)
[Sun May 10 22:37:29.327545 2026] [security2:error] [pid 172806:tid 173058] [client 188.166.12.135:19182] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsec ...
show more
[Sun May 10 22:37:29.327545 2026] [security2:error] [pid 172806:tid 173058] [client 188.166.12.135:19182] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weavernet.at"] [uri "/.env"] [unique_id "agDsifNbGuuOvX4KVVINLAAAA5U"]
[Sun May 10 22:37:29.501239 2026] [security2:error] [pid 172806:tid 173067] [client 188.166.12.135:19178] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modse
...
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-05-10 20:24:05
UTC ·
(6 months ago)
188.166.12.135 - - [10/May/2026:23:24:05 +0300] "GET /backend/.env HTTP/1.1" 404 3272 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0"
...
Web App Attack
🇫🇷
dynamix
2026-05-10 19:56:50
UTC ·
(6 months ago)
Multiple WAF Violations
Web App Attack
🇫🇷
Rom74
2026-05-10 16:42:44
UTC ·
(6 months ago)
[Sun May 10 18:42:44.233716 2026] [security2:error] [pid 362297:tid 135922293143232] [client 188.166.12.135:24254] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/shar ...
show more
[Sun May 10 18:42:44.233716 2026] [security2:error] [pid 362297:tid 135922293143232] [client 188.166.12.135:24254] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "teslogiciels.com"] [uri "/.env.local"] [unique_id "agC1hGjoeo8Pyh8L_OAbCgAAAAY"]
[Sun May 10 18:42:44.320774 2026] [security2:error] [pid 362297:tid 135921739486912] [client 188.166.12.135:27274] [client 188.166.12.135] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Excee
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-10 15:55:50
UTC ·
(6 months ago)
(mod_security) mod_security (id:949110) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 11:55:47.455153 2026] [security2:error] [pid 20965:tid 20965] [client 188.166.12.135:46288] ...
show more
(mod_security) mod_security (id:949110) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 11:55:47.455153 2026] [security2:error] [pid 20965:tid 20965] [client 188.166.12.135:46288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "crazycontrols.com"] [uri "/.env"] [unique_id "agCqg893rjzseEubGHb-1wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-05-10 15:34:10
UTC ·
(6 months ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
TPI-Abuse
2026-05-10 15:16:52
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 11:16:46.087134 2026] [security2:error] [pid 11314:tid 11314] [client 188.166.12.135:65174] ...
show more
(mod_security) mod_security (id:210492) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 11:16:46.087134 2026] [security2:error] [pid 11314:tid 11314] [client 188.166.12.135:65174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toppress.ca"] [uri "/.env"] [unique_id "agChXn4XoeCouXx3e-SDtwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-10 14:57:19
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 10:57:12.429912 2026] [security2:error] [pid 30764:tid 30764] [client 188.166.12.135:40910] ...
show more
(mod_security) mod_security (id:210492) triggered by 188.166.12.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 10:57:12.429912 2026] [security2:error] [pid 30764:tid 30764] [client 188.166.12.135:40910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "saboun.com"] [uri "/.env"] [unique_id "agCcyNbZvKOvE3JYqlDhTgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack