2026-06-18 06:32:28
(2 days ago)
216.126.236.167 - - [18/Jun/2026:14:32:27 +0800] "GET /.env HTTP/1.1" 301 239 "-" "Mozilla/5.0 (X11; ...
show more
216.126.236.167 - - [18/Jun/2026:14:32:27 +0800] "GET /.env HTTP/1.1" 301 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
Major Hostility
2026-06-18 06:01:30
(2 days ago)
"GET /.env HTTP/1.1" 404
"GET /.env HTTP/1.1" 404
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 00:34:42
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy ...
show more
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 20:34:37.795620 2026] [security2:error] [pid 15798:tid 15798] [client 216.126.236.167:56452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "astglobalgroup.com"] [uri "/.env"] [unique_id "ajM9HWJKUnU95RibHI58tQAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-17 18:05:03
(2 days ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 16:01:02
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy ...
show more
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 12:00:55.343892 2026] [security2:error] [pid 5641:tid 5641] [client 216.126.236.167:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sportsbookcommission.com"] [uri "/.env"] [unique_id "ajLEt-rNgvfN4K2xai4a6wAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 09:59:18
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy ...
show more
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 05:59:15.546413 2026] [security2:error] [pid 12111:tid 12111] [client 216.126.236.167:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chaitanyaconsult.in"] [uri "/.env"] [unique_id "ajJv82YGGydx_JcrjmDg7QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 07:50:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy ...
show more
(mod_security) mod_security (id:210492) triggered by 216.126.236.167 (167.236.126.216.static.cloudzy.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 03:50:50.690044 2026] [security2:error] [pid 21241:tid 21241] [client 216.126.236.167:55957] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robotsinme.org"] [uri "/.env"] [unique_id "ajJR2tU1fiz29yX38alVAQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-06-17 05:45:52
(3 days ago)
Try to access /.env
Web App Attack
🇺🇸
EchoGuard
2026-04-06 14:01:15
(2 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
🇺🇸
EchoGuard
2026-04-02 20:37:30
(2 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
🇹🇷
Guardpot
2026-04-02 15:35:02
(2 months ago)
This IP address has been observed conducting malicious activity across 26,524 events involving 1 dif ...
show more
This IP address has been observed conducting malicious activity across 26,524 events involving 1 different attack vectors, first seen on 2026-03-18 18:46 UTC and last active on 2026-04-02 15:35 UTC. Observed activity includes: Web application brute-force login attempts (26,524 events). Reported by Guardpot.
show less
Brute-Force
Web App Attack
🇺🇸
EchoGuard
2026-03-30 15:09:47
(2 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
🇺🇸
fbarela
2026-03-18 19:00:07
(3 months ago)
FortiGate SSL VPN login failures.
Brute-Force
Hacking