2026-08-01 17:10:02
(2 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.bak HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.l ...
show more
Bot / scanning and/or hacking attempts: GET /.env.bak HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.old HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env HTTP/1.1
show less
Hacking
Web App Attack
🇱🇹
NotACaptcha
2026-08-01 15:49:12
(3 hours ago)
webserver:443 [01/Aug/2026] "GET /.env.dev HTTP/1.1" 302 5826 "-" "crusader-worker/1.0"
webserver:4 ...
show more
webserver:443 [01/Aug/2026] "GET /.env.dev HTTP/1.1" 302 5826 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.production HTTP/1.1" 302 5840 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.bak HTTP/1.1" 302 5826 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env HTTP/1.1" 302 5818 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.save HTTP/1.1" 302 5828 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.local HTTP/1.1" 302 5830 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.prod HTTP/1.1" 302 5828 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.backup HTTP/1.1" 302 5832 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.example HTTP/1.1" 302 5834 "-" "crusader-worker/1.0"
webserver:443 [01/Aug/2026] "GET /.env.old HTTP/1.1" 302 5826 "-" "crusader-worker/1.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:42:58
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:42:52.553731 2026] [security2:error] [pid 937903:tid 937903] [client 34.47.224.106:40054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "buanamegah.com"] [uri "/.env.production"] [unique_id "am4T_PGdPB-GP0Ck6uBDqQAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 15:23:32
(4 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 14:31:51
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 10:31:47.677695 2026] [security2:error] [pid 2623962:tid 2623962] [client 34.47.224.106:51254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "serconpri.com"] [uri "/.env.save"] [unique_id "am4DUxZhE4MYY3htjjt4JAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-08-01 14:15:47
(5 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇩🇪
Ba-Yu
2026-08-01 14:04:58
(5 hours ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇫🇷
dynamix
2026-08-01 13:59:01
(5 hours ago)
Multiple WAF Violations
Web App Attack
🇧🇾
lns.bz
2026-08-01 13:48:03
(5 hours ago)
Too many 404 requests [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 13:36:45
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 09:36:37.480932 2026] [security2:error] [pid 2273773:tid 2273773] [client 34.47.224.106:37668] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "northwestarbor-culture.com.nwtree.com"] [uri "/.env.example"] [unique_id "am32Zfj-I_LhvPP56gVBhwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
paissangroup
2026-08-01 13:13:14
(6 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
COMAITE
2026-08-01 12:50:11
(6 hours ago)
Suspicious URL access.
Web App Attack
🇬🇧
consul.to
2026-08-01 12:47:32
(6 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
e.fierstra
2026-08-01 12:46:21
(6 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 12:19:09
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.47.224.106 (106.224.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 08:19:04.907564 2026] [security2:error] [pid 2022789:tid 2022789] [client 34.47.224.106:34396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.brandoncomputergeeks.com"] [uri "/.env.example"] [unique_id "am3kOIQqz4ECFmmBM5BxqAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack