🇩🇪
ketovoila.pl
2026-03-31 22:03:55
UTC ·
(7 months ago)
ketovoila.pl HONEYPOT traffic: count=2, paths=1; sample_path=ketovoila.pl/.env; UA=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0; window=2026-03-31T15:16:36Z..2026-03-31T10:36:37Z
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-03-31 22:01:47
UTC ·
(7 months ago)
Auto-ban: >3000 req/min op 2026-03-31
Web App Attack
SSH
Hacking
🇧🇪
cmbplf
2026-03-31 16:42:12
UTC ·
(7 months ago)
3.170 requests with url.path *.env
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-31 15:21:55
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 11:21:48.778928 2026] [security2:error] [pid 17091:tid 17091] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 11:21:48.778928 2026] [security2:error] [pid 17091:tid 17091] [client 192.162.68.201:50492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bigkevsperformance.com"] [uri "/.env"] [unique_id "acvmjAK3X3LnilAv64sBoAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-03-31 15:15:56
UTC ·
(7 months ago)
Honeypot access: Environment file access attempt. Path: /.env
Web App Attack
🇫🇷
Baking333
2026-03-31 15:09:47
UTC ·
(7 months ago)
[redacted] 192.162.68.201 - - [31/Mar/2026:16:08:55 +0100] "GET /.env HTTP/2.0" 301 287 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 192.162.68.201 - - [31/Mar/2026:16:08:56 +0100] "GET /fr/.env/ ...
show more
[redacted] 192.162.68.201 - - [31/Mar/2026:16:08:55 +0100] "GET /.env HTTP/2.0" 301 287 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 192.162.68.201 - - [31/Mar/2026:16:08:56 +0100] "GET /fr/.env/ HTTP/2.0" 404 25574 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-03-31 15:08:33
UTC ·
(7 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇮🇩
securejdprop
2026-03-31 15:05:37
UTC ·
(7 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access. WAF block: crowdsecurity/vpatch-env-access from 192.162.68.201 (172.18.0.4)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 15:05:10
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 11:05:02.249513 2026] [security2:error] [pid 12281:tid 12281] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 11:05:02.249513 2026] [security2:error] [pid 12281:tid 12281] [client 192.162.68.201:44938] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chelseafootballprogrammes.com"] [uri "/.env"] [unique_id "acvinn0m2pe9W1lq1m8urwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-03-31 15:03:56
UTC ·
(7 months ago)
Blocking for trying to access an exploit file: /.env
Hacking
🇵🇾
armandosaucedo.me
2026-03-31 15:02:04
UTC ·
(7 months ago)
Threat Intelligence via ARMTI, Web Attack: GET /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 14:44:05
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 10:43:59.009485 2026] [security2:error] [pid 26804:tid 26804] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 10:43:59.009485 2026] [security2:error] [pid 26804:tid 26804] [client 192.162.68.201:34088] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.floridausa.com"] [uri "/wmia/.env"] [unique_id "acvdr-OgjS7jwoJ48uMCoAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ketovoila.pl
2026-03-31 11:01:57
UTC ·
(7 months ago)
ketovoila.pl HONEYPOT traffic: count=1, paths=1; sample_path=ketovoila.pl/.env; UA=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0; window=2026-03-31T10:36:37Z..2026-03-31T10:36:37Z
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-03-31 10:16:25
UTC ·
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 06:16:18.358450 2026] [security2:error] [pid 5695:tid 5695] [client ...
show more
(mod_security) mod_security (id:210492) triggered by 192.162.68.201 (vps119289.serveur-vps.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 06:16:18.358450 2026] [security2:error] [pid 5695:tid 5695] [client 192.162.68.201:35018] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "easternimport.com"] [uri "/.env"] [unique_id "acue8hruy2WcQqNo8fSwkAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-03-31 10:08:53
UTC ·
(7 months ago)
Triggered Cloudflare WAF (firewallCustom) from FR.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 • Generated by: github.com/sefinek/Cloudflare-WAF-T ...
show more
Triggered Cloudflare WAF (firewallCustom) from FR.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot