🇫🇷
abuseipdb.amaze321
2026-10-19 18:33:44
(1 day ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇫🇷
ELYAZ
2026-10-14 19:05:39
(6 days ago)
(y3) Failed access -byebye- from 205.147.26.6 (LU/Luxembourg/-): (CF_ENABLE)
Hacking
🇵🇱
sefinek.net
2026-10-14 11:21:24
(6 days ago)
Triggered Cloudflare WAF (firewallCustom) from LU.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint ...
show more
Triggered Cloudflare WAF (firewallCustom) from LU.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0. • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
Baking333
2026-10-14 05:51:18
(6 days ago)
[redacted] 205.147.26.6 - - [14/Oct/2026:06:51:16 +0100] "GET /.env HTTP/1.1" 302 6753 0/52474 "-" " ...
show more
[redacted] 205.147.26.6 - - [14/Oct/2026:06:51:16 +0100] "GET /.env HTTP/1.1" 302 6753 0/52474 "-" "Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 EdgA/134.0.3124.68" 443 [redacted] 205.147.26.6 - - [14/Oct/2026:06:51:16 +0100] "GET /.[redacted] HTTP/1.1" 302 6753 0/149699 "-" "Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 EdgA/134.0.3124.68" 443
show less
Bad Web Bot
Web App Attack
🇩🇪
IVski.com
2026-10-14 01:10:59
(1 week ago)
IVski WAF | Sensitive file probe detected - looking for .env
Hacking
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-14 01:04:23
(1 week ago)
[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 205.147.26.6 - - [14/Oct/2026:03:04:17 +0200] "GET /.env HTTP/2.0" 404 2898 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Xbox; Xbox One) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edge/44.18363.8131"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
JPPO
2026-10-13 22:19:46
(1 week ago)
2 hits : GET /.env or GET //.env with or without prefix /api,/config ...
Web App Attack
🇺🇸
JustMeHere
2026-10-13 17:26:49
(1 week ago)
[Tue Oct 13 13:26:44.749907 2026] [security2:error] [pid 79977:tid 80102] [client 205.147.26.6:4279] ...
show more
[Tue Oct 13 13:26:44.749907 2026] [security2:error] [pid 79977:tid 80102] [client 205.147.26.6:4279] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "test2.yorknation.com"] [uri "/.env.example"] [unique_id "as5p1DvP-mmN1tOdeWWroQAAAEw"]
...
show less
Web App Attack
🇩🇪
big-cloud.nl
2026-10-13 13:54:07
(1 week ago)
Try to access /.env
Web App Attack
2026-10-13 12:24:02
(1 week ago)
Bot / scanning and/or hacking attempts: [0/0] init, GET /.env.example HTTP/2.0, [1/1] done, GET /.en ...
show more
Bot / scanning and/or hacking attempts: [0/0] init, GET /.env.example HTTP/2.0, [1/1] done, GET /.env HTTP/2.0
show less
Hacking
Web App Attack
🇿🇦
conure.sh
2026-10-13 12:14:05
(1 week ago)
csagent: score 20.3: secrets grab x2, 404 noise floor x2; 1 domain(s) in 3s
Web App Attack
🇩🇪
pltcldvlpr
2026-10-13 09:38:22
(1 week ago)
CMS/framework probe: 205.147.26.6 - - [13/Oct/2026:11:38:21 +0200] "GET /.env.example HTTP/2.0" 404 ...
show more
CMS/framework probe: 205.147.26.6 - - [13/Oct/2026:11:38:21 +0200] "GET /.env.example HTTP/2.0" 404 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" asn=7979 org="Servers.com, Inc." country=LU
...
show less
Web App Attack
🇫🇷
lindi
2026-10-13 07:34:11
(1 week ago)
trying to access .env file
...
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 02:14:10
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 205.147.26.6 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 205.147.26.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:14:06.226180 2026] [security2:error] [pid 22572:tid 22572] [client 205.147.26.6:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cdn-3.socialstudiesforkids.com"] [uri "/.env.example"] [unique_id "as2T7teDUIFP98dSLIB8wAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-13 01:12:37
(1 week ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 205 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 205.147.26.6 - - \[13/Oct/2026:03:11:16 +0200\] "GET /.env HTTP/1.1" 301 5603 "-" "Mozilla/5.0 \(iPad\; CPU OS 17_7_2 like Mac OS X\) AppleWebKit/605.1.15 \(KHTML, like Gecko\) Version/18.3 Mobile/15E148 Safari/604.1"
...
show less
Bad Web Bot
Web App Attack
