🇹🇷
oalver
2026-10-05 12:00:50
(1 week ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signa ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /api/.env (HTTP 301). First seen: 2026-10-02. Risk score: 30/100.
show less
Web App Attack
🇫🇷
Catalin Negru
2026-10-05 01:37:21
(2 weeks ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇫🇷
dynamix
2026-10-05 00:46:39
(2 weeks ago)
Multiple WAF Violations
Web App Attack
2026-10-04 23:58:43
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 47.107.103.49 (CN/China/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-10-04 22:46:45
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 18:46:37.893440 2026] [security2:error] [pid 30910:tid 30910] [client 47.107.103.49:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/.env.prod"] [unique_id "asLXTfO8EVZ-tkqvudYbWgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 22:05:24
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 18:05:19.174809 2026] [security2:error] [pid 27249:tid 27249] [client 47.107.103.49:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "globetechsecurities.com"] [uri "/.env"] [unique_id "asLNn7dfFF0VaSzTs0tVwgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-10-04 21:12:04
(2 weeks ago)
2026/10/04 21:12:01 [error] 3447619#3447619: *16555345 access forbidden by rule, client: 47.107.103. ...
show more
2026/10/04 21:12:01 [error] 3447619#3447619: *16555345 access forbidden by rule, client: 47.107.103.49, server: 100fs.org, request: "GET /.env.production HTTP/1.1", host: "100fs.org"
2026/10/04 21:12:02 [error] 3447619#3447619: *16555355 access forbidden by rule, client: 47.107.103.49, server: 100fs.org, request: "GET /.env.local HTTP/1.1", host: "100fs.org"
2026/10/04 21:12:02 [error] 3447619#3447619: *16555371 access forbidden by rule, client: 47.107.103.49, server: 100fs.org, request: "GET /.env.backup HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
🇩🇪
svr
2026-10-04 21:10:05
(2 weeks ago)
Abusive Automated Web Scanner
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 17:43:52
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 13:43:46.850962 2026] [security2:error] [pid 22004:tid 22004] [client 47.107.103.49:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vidacellenlaweb.com"] [uri "/files/.env"] [unique_id "asKQUqUCocewckeF45TCAQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WizardsToolkit
2026-10-04 15:21:08
(2 weeks ago)
tried to access forbidden files; attempted to access /app/.env
Web App Attack
🇩🇪
4server
2026-10-04 15:06:30
(2 weeks ago)
[SunOct0417:06:27.8143962026][security2:error][pid1048702:tid1048805][client47.107.103.49:0]ModSecur ...
show more
[SunOct0417:06:27.8143962026][security2:error][pid1048702:tid1048805][client47.107.103.49:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"gmint.ch\"][uri\"/api/.env\"][unique_id\"asJrc2tB60oDMg6fS8tmhwAAAk4\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-04 14:44:30
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
bazter.pro
2026-10-04 12:43:18
(2 weeks ago)
Fail2Ban: plesk-bot-aggressive - 15 failures
Port Scan
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-10-04 12:12:03
(2 weeks ago)
2026/10/04 12:12:00 [error] 3197179#3197179: *15247713 access forbidden by rule, client: 47.107.103. ...
show more
2026/10/04 12:12:00 [error] 3197179#3197179: *15247713 access forbidden by rule, client: 47.107.103.49, server: bin-spin.com, request: "GET /files/.env HTTP/1.1", host: "bin-spin.com"
2026/10/04 12:12:00 [error] 3197179#3197179: *15247724 access forbidden by rule, client: 47.107.103.49, server: bin-spin.com, request: "GET /.env.save HTTP/1.1", host: "bin-spin.com"
2026/10/04 12:12:01 [error] 3197179#3197179: *15247743 access forbidden by rule, client: 47.107.103.49, server: bin-spin.com, request: "GET /backup/.env HTTP/1.1", host: "bin-spin.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 09:31:17
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 47.107.103.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 05:31:10.286914 2026] [security2:error] [pid 1271:tid 1271] [client 47.107.103.49:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "antitribu.com"] [uri "/files/.env"] [unique_id "asIc3ogJzzwAFKgHYUx_BwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
