🇺🇸
Starburst SysOp Team
2026-06-15 09:13:48
(29 minutes ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-stl2-14)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 08:49:38
(53 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 04:49:33.494822 2026] [security2:error] [pid 11219:tid 11219] [client 34.55.66.180:47730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tlphotogifts.com"] [uri "/.env"] [unique_id "ai-8nWuYjKSz1aj2kFcncwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-15 08:25:10
(1 hour ago)
(modsecurity) srv201 ModSecurity 34.55.66.180 (US/United States/180.66.55.34.bc.googleusercontent.co ...
show more
(modsecurity) srv201 ModSecurity 34.55.66.180 (US/United States/180.66.55.34.bc.googleusercontent.com): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
kosada.com
2026-06-15 07:07:02
(2 hours ago)
Web vulnerability probing: /.env.stage
Web App Attack
🇬🇧
consul.to
2026-06-15 06:30:54
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
Octopuce
2026-06-15 03:31:34
(6 hours ago)
Aggressive web search of vulnerable pages: /app/api/.env /backend/.env.local /backend/.env /frontend ...
show more
Aggressive web search of vulnerable pages: /app/api/.env /backend/.env.local /backend/.env /frontend/.env /prod/.env ...
show less
Web App Attack
🇫🇷
masterguru
2026-06-15 01:19:36
(8 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇺🇸
mnsf
2026-06-15 00:07:37
(9 hours ago)
Abuse Detected (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:58:57
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:58:54.990727 2026] [security2:error] [pid 17984:tid 18002] [client 34.55.66.180:56074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mouawadarchitects.com"] [uri "/admin/.env"] [unique_id "ai9APrnK6wgMFOJSNS9KnwAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-06-14 19:11:57
(14 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
big-cloud.nl
2026-06-14 16:14:59
(17 hours ago)
Try to access /api/v3/.env
Web App Attack
🇬🇧
Oakley
2026-06-14 10:03:55
(23 hours ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇩🇪
Dominik Lysiak
2026-06-14 07:51:42
(1 day ago)
34.55.66.180 - - [14/Jun/2026:09:51:41 +0200] "GET /.env.local.bak HTTP/1.1" 404 178 "-" "Mozilla/5. ...
show more
34.55.66.180 - - [14/Jun/2026:09:51:41 +0200] "GET /.env.local.bak HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.10 Safari/537.36 Edg/77.0.235.5"
34.55.66.180 - - [14/Jun/2026:09:51:41 +0200] "GET /.env.orig HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
34.55.66.180 - - [14/Jun/2026:09:51:41 +0200] "GET /.env.dev HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.6.1000"
...
show less
Web App Attack
2026-06-14 07:33:08
(1 day ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 06:49:46
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.55.66.180 (180.66.55.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 02:49:40.255430 2026] [security2:error] [pid 8378:tid 8378] [client 34.55.66.180:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.abdulhameeds.art"] [uri "/.env.orig"] [unique_id "ai5PBATJh-BwvaCWKN1e6AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack