🇳🇱
ams_sec_user
2026-11-09 08:05:28
UTC ·
(20 minutes ago)
Automated requests against a hosted website: 26 requests between 07:00 and 07:59 UTC; 20 probes for exposed secrets/config files (/.env, /.env.bak, /.env.old). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
2026-11-09 08:00:14
UTC ·
(26 minutes ago)
$f2bV_matches
Brute-Force
🇫🇷
bazter.pro
2026-11-09 07:34:34
UTC ·
(51 minutes ago)
Fail2Ban: apache-ratelimit - 20 failures
Port Scan
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-11-09 06:49:51
UTC ·
(1 hour ago)
2026/11/09 06:49:50 [error] 1295371#1295371: *18631582 access forbidden by rule, client: 206.189.4.241, server: binixo.mx, request: "GET /.git/config HTTP/1.1", host: "binixo.mx"
2026/11/09 06:49:50 [error] 1295371#1295371: *18631582 access forbidden ...
show more
2026/11/09 06:49:50 [error] 1295371#1295371: *18631582 access forbidden by rule, client: 206.189.4.241, server: binixo.mx, request: "GET /.git/config HTTP/1.1", host: "binixo.mx"
2026/11/09 06:49:50 [error] 1295371#1295371: *18631582 access forbidden by rule, client: 206.189.4.241, server: binixo.mx, request: "GET /.git/HEAD HTTP/1.1", host: "binixo.mx"
2026/11/09 06:49:50 [error] 1295369#1295369: *18631586 access forbidden by rule, client: 206.189.4.241, server: binixo.ph, request: "GET /.git/config HTTP/1.1", host: "binixo.ph"
...
show less
Web App Attack
🇩🇪
niedson
2026-11-09 05:30:02
UTC ·
(2 hours ago)
Automated scanning for exposed secrets: repeated requests for multiple distinct credential paths (.env variants, .git metadata, .ssh private keys, .aws/credentials). Unsolicited. Reported automatically.
Web App Attack
🇺🇸
Starburst SysOp Team
2026-11-09 04:21:39
UTC ·
(4 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-srv1)
Hacking
Web App Attack
🇷🇴
clauss
2026-11-09 00:05:52
UTC ·
(8 hours ago)
206.189.4.241 - - [09/Nov/2026:02:05:49 +0200] "GET /.env.bak HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
206.189.4.241 - - [09/Nov/2026:02:05:49 +0200] "GET ...
show more
206.189.4.241 - - [09/Nov/2026:02:05:49 +0200] "GET /.env.bak HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
206.189.4.241 - - [09/Nov/2026:02:05:49 +0200] "GET /.env.old HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇳🇱
Site.eu
2026-11-08 21:39:17
UTC ·
(10 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-11-08 17:16:31
UTC ·
(15 hours ago)
2026-11-08 13:04:40-13:04:44 UTC: six web requests probing sensitive configuration paths including /.env, /.env.bak, /.env.old, /.env.local and /.env.production. Responses 403 and 429. No compromise established.
Web App Attack
🇬🇧
KTSTechnology
2026-11-08 17:00:03
UTC ·
(15 hours ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 14:58:13
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.189.4.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:58:07.801534 2026] [security2:error] [pid 22629:tid 22629] [client 206.189.4.241:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 206.189.4.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:58:07.801534 2026] [security2:error] [pid 22629:tid 22629] [client 206.189.4.241:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kidswithcamerasmovie.com"] [uri "/.env"] [unique_id "avCN_1Y92Y-ENuWjFqPrwAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Autonomous-eu
2026-11-08 14:37:56
UTC ·
(17 hours ago)
Scanner: requested /.env
Web App Attack
🇬🇧
Aetherweb Ark
2026-11-08 13:01:47
UTC ·
(19 hours ago)
(mod_security) mod_security (id:949110) triggered by 206.189.4.241 (NL/The Netherlands/-): N in the last X secs
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 09:45:16
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.189.4.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:45:10.516035 2026] [security2:error] [pid 29566:tid 29566] [client 206.189.4.241:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 206.189.4.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:45:10.516035 2026] [security2:error] [pid 29566:tid 29566] [client 206.189.4.241:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "luisguacache.com"] [uri "/.env"] [unique_id "avBEpr82lgJwl6fzFCwXsAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-08 06:17:28
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: budyn.top | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: budyn.top | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
