🇺🇸
TPI-Abuse
2026-10-16 23:51:42
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 19:51:36.132253 2026] [security2:error] [pid 22868:tid 22868] [client 38.240.50.89:61445] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3dstores.com"] [uri "/.env"] [unique_id "atK4iDiVmPnYkaDBoAmPhAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-15 09:43:58
(2 days ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 38.240.50.89 - - [15/Oct/2026:11:43:49 +0200] "GET /.env HTTP/1.1" 404 2110 "-" "python-requests/2.34.2"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-14 21:59:06
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-13.
show less
Web App Attack
SSH
Hacking
2026-10-14 20:49:22
(2 days ago)
Scan for .env Files at 2026-10-14T20:49:22+00:00
Web App Attack
🇵🇱
Budyn
2026-10-14 20:43:46
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: db.astropot.site | URI: /.env | UA: python-requests/2.34.2 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 17:31:57
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 13:31:51.275879 2026] [security2:error] [pid 19988:tid 20050] [client 38.240.50.89:50410] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dashcammvp.com"] [uri "/.env"] [unique_id "as-8h8AYDxzp_nwKyiLpQwAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
stdcout9090
2026-10-14 12:06:19
(3 days ago)
AetherGuard WAF blocked: Matched phrase "/.env" at REQUEST_URI.
Target: ctf-management.aetherguard.x ...
show more
AetherGuard WAF blocked: Matched phrase "/.env" at REQUEST_URI.
Target: ctf-management.aetherguard.xyz/.env
Payload / matched WAF rule data:
User-Agent: python-requests/2.34.2
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 09:59:17
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 05:59:11.180101 2026] [security2:error] [pid 20966:tid 20966] [client 38.240.50.89:58241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dancingmountainsbrewing.com"] [uri "/.env"] [unique_id "as9Sbw-UpntMLXlKLpsPowAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-14 09:22:53
(3 days ago)
Scanner hitting /.env on (NET-38-240-50-0-24) — aaguard
Brute-Force
Port Scan
2026-10-14 06:44:35
(3 days ago)
sensitive path probe detected by fail2ban
...
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 04:24:51
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:24:45.943231 2026] [security2:error] [pid 17914:tid 17914] [client 38.240.50.89:58645] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyberviews.club"] [uri "/.env"] [unique_id "as8EDVyMB37JSK1I4PmujQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-14 01:51:34
(3 days ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 38.240.50.89 - - [14/Oct/2026:03:51:25 +0200] "GET /.env HTTP/1.1" 301 485 "-" "python-requests/2.34.2"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ut-addicted.com
2026-10-13 23:04:56
(3 days ago)
\[Wed Oct 14 01:04:53.845099 2026\] \[:error\] \[pid 27941:tid 140352608528128\] \[client 38.240.50. ...
show more
\[Wed Oct 14 01:04:53.845099 2026\] \[:error\] \[pid 27941:tid 140352608528128\] \[client 38.240.50.89:61514\] \[client 38.240.50.89\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "crx.it"\] \[uri "/.env"\] \[unique_id "as65FU30szPw07AIZxw3DgAAAMI"\]
show less
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-13 21:59:11
(3 days ago)
Auto-ban: >3000 req/min op 2026-10-13
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-13 21:55:25
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 38.240.50.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 17:55:18.703104 2026] [security2:error] [pid 326:tid 326] [client 38.240.50.89:49762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crm.kircali.net"] [uri "/.env"] [unique_id "as6oxgonwlZPYF3rawl0TgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack