🇵🇱
Budyn
2026-08-24 19:18:50
(6 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.astropot.space | URI: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
Aurealize
2026-08-24 17:06:59
(8 hours ago)
Automated Sensitive File discovery attempt detected by a Cloudflare WAF custom rule. Path: /.env.
Web App Attack
Hacking
🇳🇴
jad-abuse
2026-08-23 18:31:55
(1 day ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 5 hits.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 16:51:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 12:51:01.054326 2026] [security2:error] [pid 7252:tid 7252] [client 24.199.95.62:33074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alextra.org"] [uri "/.env"] [unique_id "aosk9TAaXZjvNNV1dTtB-QAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 12:54:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 08:53:57.308100 2026] [security2:error] [pid 31348:tid 31348] [client 24.199.95.62:54624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alanbeckwith.com"] [uri "/.env"] [unique_id "aortZQnOo2yEpjeRqyHxJQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 11:08:00
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:949110) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 07:07:53.789946 2026] [security2:error] [pid 8986:tid 8986] [client 24.199.95.62:39136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "akistech.com"] [uri "/.env"] [unique_id "aorUiRKdU6YlHohEJpD-2wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 07:49:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 03:49:30.112088 2026] [security2:error] [pid 1182355:tid 1182371] [client 24.199.95.62:58220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ahmedalbanna.com"] [uri "/.env"] [unique_id "aoqmCrGsB_AK39zqXqzr3wAAAEg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 07:33:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 03:33:00.050090 2026] [security2:error] [pid 14323:tid 14323] [client 24.199.95.62:48812] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ahijado.org"] [uri "/.env"] [unique_id "aoqiLCIN7LTOKZMbvLH_egAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 06:02:13
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 02:02:07.314190 2026] [security2:error] [pid 18306:tid 18306] [client 24.199.95.62:35490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agrizel.com"] [uri "/.env"] [unique_id "aoqM3-DDHVElEmD45nsgDQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 04:52:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 00:52:23.049769 2026] [security2:error] [pid 9625:tid 9625] [client 24.199.95.62:54728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agirlwithaguitar.com"] [uri "/.env"] [unique_id "aop8hz1Fy5g1zFcE5ASIYgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
P1n4
2026-08-23 02:33:17
(1 day ago)
Heimdal IDS auto-block: sensitive_file (score=0.80)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 01:47:38
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 21:47:31.662534 2026] [security2:error] [pid 22950:tid 22950] [client 24.199.95.62:54602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ageh.com"] [uri "/.env"] [unique_id "aopRM39VsuUJ6IwOt5QYEgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 01:20:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 21:19:58.463550 2026] [security2:error] [pid 25207:tid 25207] [client 24.199.95.62:52232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agapeaccountingllc.com"] [uri "/.env"] [unique_id "aopKvmOHO4P4Pz5UqMHeVwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-23 00:31:00
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 20:30:56.632932 2026] [security2:error] [pid 16155:tid 16155] [client 24.199.95.62:43622] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "afscmelocal2794.com"] [uri "/.env"] [unique_id "aoo_QHlPL0JlvVqBCQkJ0wAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-22 23:19:38
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.95.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 19:19:33.144921 2026] [security2:error] [pid 10735:tid 10735] [client 24.199.95.62:39182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "affordablehomegoods.com"] [uri "/.env"] [unique_id "aoouhc9YDCyjDU0lMGgXCgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack