Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show moreAuto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-09.
show less
{"level":"info","ts":1781001712.8778398,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1781001712.8778398,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.221.218.66","remote_port":"51228","client_ip":"35.221.218.66","proto":"HTTP/1.1","method":"GET","host":"rqtsrmlkjihgfedcbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.backup","headers":{"User-Agent":["Mozilla/5.0 (Linux; Android 9; VTR-AL00 Build/HUAWEIVTR-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/6475 MicroMessenger/7.0.6.1460(0x27000634) Process/tools NetType/4G Language/zh_CN"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000085213,"size":0,"status":308,"resp_headers":{"Location":["https://rqtsrmlkjihgfedcbwwwc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.env.backup"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"level":"info
...
show less
DDoS Attack
Web App Attack
Anonymous
Bot / scanning and/or hacking attempts: GET /app/.env.local HTTP/1.1, GET /app/.env.bak HTTP/1.1, GE ...
show moreBot / scanning and/or hacking attempts: GET /app/.env.local HTTP/1.1, GET /app/.env.bak HTTP/1.1, GET /backend/.env.old HTTP/1.1, GET /services/api/.env HTTP/1.1, GET /api/.env.staging HTTP/1.1, GET /src/.env.backup HTTP/1.1, GET /frontend/.env.dev HTTP/1.1, GET /admin/.env.backup HTTP/1.1, GET /backend/.env HTTP/1.1, GET /packages/api/.env HTTP/1.1, GET /app/api/.env HTTP/1.1, GET /laravel/.env HTTP/1.1, GET /wp/.env HTTP/1.1, GET /wordpress/.env HTTP/1.1, GET /backend/.env.staging HTTP/1.1, GET /api/backend/.env HTTP/1.1, GET /backend/.env.bak HTTP/1.1
show less
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.221.218.66 (TW/Taiwan/66.218.221.3 ...
show more(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.221.218.66 (TW/Taiwan/66.218.221.35.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
show less
Hacking
Anonymous
Scenarios: http-bad-user-agent, http-sensitive-files
Total requests: 151
[09/Jun/2026:03:47:38 +0000 ...
show moreScenarios: http-bad-user-agent, http-sensitive-files
Total requests: 151
[09/Jun/2026:03:47:38 +0000] [Client: 35.221.218.66] GET [200] "/.env.old HTTP/1.1" User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3844.0 Safari/537.36"
[09/Jun/2026:03:47:38 +0000] [Client: 35.221.218.66] GET [200] "/.env.copy HTTP/1.1" User-Agent: "Opera/9.0 (Macintosh; PPC Mac OS X; U; en)"
[09/Jun/2026:03:47:38 +0000] [Client: 35.221.218.66] GET [200] "/.env.staging HTTP/1.1" User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"
[09/Jun/2026:03:47:38 +0000] [Client: 35.221.218.66] GET [200] "/.env.production HTTP/1.1" User-Agent: "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36"
show less