Anonymous
2026-11-13 17:15:04
UTC ·
(45 minutes ago)
Bot / scanning and/or hacking attempts: GET /.env.docker HTTP/1.1, GET /.env_copy HTTP/1.1, GET /.env.live HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.yml HTTP/1.1, GET /admin/.env HTTP/1.1, GET /.env.uat HTTP/1.1, GET /.env.preprod HTTP/1.1, GET /.e ...
show more
Bot / scanning and/or hacking attempts: GET /.env.docker HTTP/1.1, GET /.env_copy HTTP/1.1, GET /.env.live HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.yml HTTP/1.1, GET /admin/.env HTTP/1.1, GET /.env.uat HTTP/1.1, GET /.env.preprod HTTP/1.1, GET /.env2 HTTP/1.1, GET /api/.env HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.json HTTP/1.1, GET /.env~ HTTP/1.1, GET /apps/.env HTTP/1.1, GET /.env.txt HTTP/1.1, GET /app/.env HTTP/1.1, GET /web/.env HTTP/1.1, GET /.env1 HTTP/1.1, GET /.env.ci HTTP/1.1, GET /backend/.env HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /server/.env HTTP/1.1, GET /site/.env HTTP/1.1, GET /public/.env HTTP/1.1
show less
Hacking
Web App Attack
🇧🇪
voormedia
2026-11-13 16:49:19
UTC ·
(1 hour ago)
Accessed trap at '/.git/config'
Web App Attack
Anonymous
2026-11-13 16:10:20
UTC ·
(1 hour ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 15:47:19
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:47:15.748878 2026] [security2:error] [pid 8761:tid 876 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:47:15.748878 2026] [security2:error] [pid 8761:tid 8761] [client 34.148.51.44:38254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "accentcorporatemedia.com"] [uri "/.git/config"] [unique_id "avcxAzGZPd9p0Kc2PmaDBQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
msavo
2026-11-13 13:20:07
UTC ·
(4 hours ago)
CIR Sentinel: env_probe_permanent; 8 requests in 60s; targets=/.env, /.env.bak, /.env.development, /.env.local, /.env.production; permanently blocked by local firewall.
Web App Attack
🇳🇱
Alt255
2026-11-13 12:35:01
UTC ·
(5 hours ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.148.51.44 - - [13/Nov/2026:13:34:45 +0100] "GET /.git/config HTTP/1.1" 403 2175 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.148.51.44 - - [13/Nov/2026:13:34:45 +0100] "GET /.git/config HTTP/1.1" 403 2175 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇰
floyd_dk
2026-11-13 12:00:49
UTC ·
(5 hours ago)
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET ...
show more
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET /.git/config HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET /.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET /.env.local HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.148.51.44 - - [13/Nov/2026:12:00:47 +0000] "GET /.env.production HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.148.51.44 - - [13/Nov/2026:12:00:48 +0000] "GET /.env.staging HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.
...
show less
Web App Attack
🇳🇱
Savvii
2026-11-13 11:47:04
UTC ·
(6 hours ago)
20 attempts against mh_ha-misbehave-ban on pf102960
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
[email protected]
2026-11-13 11:37:25
UTC ·
(6 hours ago)
Detected by fail2ban (nginx-deny)
Web App Attack
🇧🇪
cmbplf
2026-11-13 11:22:48
UTC ·
(6 hours ago)
2.067 requests with url.path *.env
323 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇳🇱
Savvii
2026-11-13 10:38:31
UTC ·
(7 hours ago)
20 attempts against mh-misbehave-ban on pf102960
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:41:51
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:41:46.052441 2026] [security2:error] [pid 11035:tid 11 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:41:46.052441 2026] [security2:error] [pid 11035:tid 11035] [client 34.148.51.44:50900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acatucson.com"] [uri "/.git/config"] [unique_id "avbbWmXJZ1sVucQXHfo8CgAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-13 09:15:32
UTC ·
(8 hours ago)
[ns41.kdns.gr] httpd-config-scan: sites=acas.gr; logs=/var/log/httpd/domains/acas.gr.log; samples=/.git/config | /.env | /.env.local
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:12:37
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:12:30.783167 2026] [security2:error] [pid 19723:tid 19 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.148.51.44 (44.51.148.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:12:30.783167 2026] [security2:error] [pid 19723:tid 19723] [client 34.148.51.44:33150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acarsubscription.com"] [uri "/.git/config"] [unique_id "avbUfr_skDpd1z8XBZWVugAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-13 09:10:11
UTC ·
(8 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection