|
🇬🇧
kie
|
|
30-09-2026:11:20:01UTC [Nginx Web Server] Suspicious web request: path:/.env (2 request(s)).
|
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
41.143.167.29 - - [30/Sep/2026:12:54:10 +0200] "GET /.env HTTP/1.1" 301 169 "-" "-"
|
Web App Attack
|
|
🇩🇪
Gwyneth Llewelyn
|
|
41.143.167.29 - - [30/Sep/2026:11:38:08 +0100] "GET /.env HTTP/2.0" 301 162 "-" "-"
2026/09/30 11:38:10 [error] 3532286#3532286: *1463003 access forbidden by rule, client: 41.143.167.29, server: mar.pt, request: "GET /.env HTTP/2.0", host: "mar.pt", ...
show more
41.143.167.29 - - [30/Sep/2026:11:38:08 +0100] "GET /.env HTTP/2.0" 301 162 "-" "-"
2026/09/30 11:38:10 [error] 3532286#3532286: *1463003 access forbidden by rule, client: 41.143.167.29, server: mar.pt, request: "GET /.env HTTP/2.0", host: "mar.pt", referrer: "https://www.mar.pt/.env"
41.143.167.29 - - [30/Sep/2026:11:38:10 +0100] "GET /.env HTTP/2.0" 403 1045 "https://www.mar.pt/.env" "-"
show less
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
Web App Attack
|
Brute-Force
Exploited Host
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 41.143.167.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:09:54.684494 2026] [security2:error] [pid 15630:tid 15630] [client 41.143.167.29:50518] M ...
show more
(mod_security) mod_security (id:210492) triggered by 41.143.167.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:09:54.684494 2026] [security2:error] [pid 15630:tid 15630] [client 41.143.167.29:50518] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rosacid.com"] [uri "/.env"] [unique_id "arzf8iL869vljHXhMliWagAAAAk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 41.143.167.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 05:39:17.483173 2026] [security2:error] [pid 30643:tid 30643] [client 41.143.167.29:35968] M ...
show more
(mod_security) mod_security (id:210492) triggered by 41.143.167.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 05:39:17.483173 2026] [security2:error] [pid 30643:tid 30643] [client 41.143.167.29:35968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "walterceron.com"] [uri "/.env"] [unique_id "arzYxdAe78lsiG1uiJBw7wAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
arsonist
|
|
[fail2ban]
2026-09-30T09:24:14.636407+00:00 arson caddy[1890453]: {"level":"info","ts":1790760254.6363556,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"41.143.167.29","remote_port":"37758","client_ip":"41.143.167. ...
show more
[fail2ban]
2026-09-30T09:24:14.636407+00:00 arson caddy[1890453]: {"level":"info","ts":1790760254.6363556,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"41.143.167.29","remote_port":"37758","client_ip":"41.143.167.29","proto":"HTTP/1.1","method":"GET","host":"md.aos.lol","uri":"/.env","headers":{"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"md.aos.lol","ech":false}},"bytes_read":0,"user_id":"","duration":0.000149242,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
|
Bad Web Bot
|
|
🇭🇷
IgorS.zg.hr
|
|
Web application attack detected by fail2ban
|
Hacking
Web App Attack
|
|
🇸🇪
Per-Erik Runebert
|
|
Excessive unauthorized requests: 443
|
Hacking
|
|
🇺🇸
Lee Daniel
|
|
41.143.167.29 - - [30/Sep/2026:04:20:17 -0400] "GET /.env HTTP/1.1" 403 344 "-" "-"
...
|
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
xxkodedxx
|
|
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 08:03:36→08:03:39 UTC
Volume: 4 honeypot probe(s)
Bait taken: /.env
Auto-banned 30d. zorvexus-banner.
|
Bad Web Bot
Web App Attack
|
|
🇫🇷
alpha
|
|
Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (/.env)
|
Bad Web Bot
Web App Attack
|
|
🇵🇱
Budyn
|
|
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: keycloak.dont-eat-the-pudding.online | URI: /.env ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: keycloak.dont-eat-the-pudding.online | URI: /.env | UA: Unknown User-Agent | BODY: [Empty / GET Request]
show less
|
Bad Web Bot
Web App Attack
|
|
🇫🇷
arsonist
|
|
[fail2ban]
2026-09-30T07:07:29.469583+00:00 arson caddy[1890453]: {"level":"info","ts":1790752049.4695585,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"41.143.167.29","remote_port":"35636","client_ip":"41.143.167. ...
show more
[fail2ban]
2026-09-30T07:07:29.469583+00:00 arson caddy[1890453]: {"level":"info","ts":1790752049.4695585,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"41.143.167.29","remote_port":"35636","client_ip":"41.143.167.29","proto":"HTTP/1.1","method":"GET","host":"sso.aos.lol","uri":"/.env","headers":{"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"sso.aos.lol","ech":false}},"bytes_read":0,"user_id":"","duration":0.000057018,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
|
Bad Web Bot
|
|
Anonymous
|
|
Automated web scanner. Requested suspicious paths: /.env. UTC: 2026-09-30 06:19:23.
|
Web App Attack
|
