🇫🇷
✨
2026-06-05 01:15:14
(1 hour ago)
Domain : quilkin.co.uk
Rule : env
2026-06-05 01:12:56 ***hidden-privacy*** GET /.env.staging - 443 - ...
show more
Domain : quilkin.co.uk
Rule : env
2026-06-05 01:12:56 ***hidden-privacy*** GET /.env.staging - 443 - 208.84.102.76 HTTP/1.1 Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1 - quilkin.co.uk 404 0 2 1419 329 110 - -
show less
Hacking
SQL Injection
🇩🇪
akasolutions.de
2026-06-05 00:38:18
(1 hour ago)
(mod_security) mod_security triggered on hostname [redacted] 208.84.102.76 (US/United States/-)
SQL Injection
🇩🇪
SwinT
2026-06-05 00:00:14
(2 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 23:53:25
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 19:53:21.092449 2026] [security2:error] [pid 14123:tid 14123] [client 208.84.102.76:19486] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.businessvaluationapp.com"] [uri "/.env.production.copy"] [unique_id "aiIP8ZJ1X58xQTdd14WQmgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-04 23:49:15
(2 hours ago)
Web vulnerability probing: /.env.test
Web App Attack
🇦🇹
penguin-solutions.at
2026-06-04 23:47:55
(2 hours ago)
Excessive 403/404 errors
...
Brute-Force
Web App Attack
🇩🇪
SCHAPPY
2026-06-04 23:45:20
(2 hours ago)
Malicious activity from IP detected: crowdsecurity/http-sensitive-files.
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-06-04 23:22:45
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 19:22:38.022493 2026] [security2:error] [pid 29843:tid 29843] [client 208.84.102.76:45084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bjfrancislaw.com"] [uri "/.env.production.copy"] [unique_id "aiIIvrTJHT5bk_IJb8leBgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-06-04 23:04:49
(3 hours ago)
*Port Scan* detected from 208.84.102.76 (US/United States/Missouri/North Kansas City/-).
Port Scan
🇺🇸
TPI-Abuse
2026-06-04 22:49:00
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 18:48:54.805792 2026] [security2:error] [pid 21947:tid 21947] [client 208.84.102.76:4226] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.monteriggioni.net"] [uri "/.env.production.bak"] [unique_id "aiIA1ukOL00-z4Suyn2J_QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-04 22:44:04
(3 hours ago)
Restricted File Access Attempt. Matched phrase ".yarnrc" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 22:21:08
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 18:21:00.599430 2026] [security2:error] [pid 26108:tid 26108] [client 208.84.102.76:55350] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.curtbeams.com"] [uri "/.env.copy"] [unique_id "aiH6TNQp-rq69cjJYWr5aAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-06-04 22:07:14
(4 hours ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
mnsf
2026-06-04 22:05:20
(4 hours ago)
Scanning/Probing (21)
Brute-Force
Web App Attack
2026-06-04 22:01:43
(4 hours ago)
(caddyscan) Scanner path probe from 208.84.102.76 (US/United States/-): 5 in the last 3600 secs; Por ...
show more
(caddyscan) Scanner path probe from 208.84.102.76 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 208.84.102.76 - - [04/Jun/2026:22:01:41 +0000] "GET /.env.development HTTP/1.1"
[REDACTED] 200 2627 208.84.102.76 - - [04/Jun/2026:22:01:41 +0000] "GET /.env.save HTTP/1.1"
[REDACTED] 200 2627 208.84.102.76 - - [04/Jun/2026:22:01:41 +0000] "GET /.env.old HTTP/1.1"
[REDACTED] 200 2627 208.84.102.76 - - [04/Jun/2026:22:01:41 +0000] "GET /app/.env HTTP/1.1"
[REDACTED] 200 2627 208.84.102.76 - - [04/Jun/2026:22:01:41 +0000] "GET /laravel/.env HTTP/1.1"
show less
Port Scan