🇺🇸
Starburst SysOp Team
2026-11-15 22:00:29
UTC ·
(13 minutes ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-mnz6-1)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 21:08:59
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:08:52.350797 2026] [security2:error] [pid 26739:tid 26739] [client 45.93.9.59:33749] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:08:52.350797 2026] [security2:error] [pid 26739:tid 26739] [client 45.93.9.59:33749] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "secure-rep.com"] [uri "/src/.env"] [unique_id "avofZBJPk2zYH8hQl0o6ugAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇬
Stoyko Stoykov
2026-11-15 20:31:44
UTC ·
(1 hour ago)
45.93.9.59 - - [15/Nov/2026:22:31:43 +0200] "GET /.env.staging HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
Hacking
Web App Attack
🇺🇸
kosada.com
2026-11-15 20:31:07
UTC ·
(1 hour ago)
Repeated requests for suspicious nonexistent URLs, for example: /.env.production (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36")
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 20:05:00
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 15:04:55.328811 2026] [security2:error] [pid 19105:tid 19105] [client 45.93.9.59:58227] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 15:04:55.328811 2026] [security2:error] [pid 19105:tid 19105] [client 45.93.9.59:58227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "puckerbackbikini.com"] [uri "/.env.local"] [unique_id "avoQZyDuyr_nmVtww-xtVAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-15 19:20:06
UTC ·
(2 hours ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 19:15:26
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:15:23.132144 2026] [security2:error] [pid 13140:tid 13140] [client 45.93.9.59:53947] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:15:23.132144 2026] [security2:error] [pid 13140:tid 13140] [client 45.93.9.59:53947] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "owenmail.com"] [uri "/.env.bak"] [unique_id "avoEywMqkTMDzbDLnOMaKgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 18:30:34
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 13:30:26.174727 2026] [security2:error] [pid 30669:tid 30669] [client 45.93.9.59:35857] ModSecu ...
show more
(mod_security) mod_security (id:210492) triggered by 45.93.9.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 13:30:26.174727 2026] [security2:error] [pid 30669:tid 30669] [client 45.93.9.59:35857] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "netguard.us"] [uri "/.env.dev"] [unique_id "avn6QiEl6qfmHjhwOycQdwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-15 17:20:02
UTC ·
(4 hours ago)
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 45.93.9.59 (GB/United Kingdom/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇨🇦
Sakusen
2026-11-15 16:18:20
UTC ·
(5 hours ago)
Automated web attack: 2 reqs, 2 paths probed, 2 returned 404; probed: 2 .env
Hacking
Web App Attack
🇹🇷
Jova
2026-11-15 16:01:55
UTC ·
(6 hours ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇮🇩
securejdprop
2026-11-15 15:53:53
UTC ·
(6 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access.
Hacking
Web App Attack
🇳🇱
Alt255
2026-11-15 15:39:00
UTC ·
(6 hours ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 45.93.9.59 - - [15/Nov/2026:16:38:46 +0100] "GET /.env.local HTTP/1.1" 404 49484 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 45.93.9.59 - - [15/Nov/2026:16:38:46 +0100] "GET /.env.local HTTP/1.1" 404 49484 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-11-15 14:32:08
UTC ·
(7 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.
Bad Web Bot
Web App Attack
🇩🇪
Bedios GmbH
2026-11-15 14:24:47
UTC ·
(7 hours ago)
Scanning for exposed credentials and private keys.
Hacking
