🇫🇷
Baking333
2026-05-25 11:04:22
UTC ·
(5 months ago)
[redacted] 54.210.148.167 - - [25/May/2026:12:04:20 +0100] "GET /.env HTTP/2.0" 301 290 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" [redacted] 54.210.148.167 - - ...
show more
[redacted] 54.210.148.167 - - [25/May/2026:12:04:20 +0100] "GET /.env HTTP/2.0" 301 290 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" [redacted] 54.210.148.167 - - [25/May/2026:12:04:20 +0100] "GET /.[redacted] HTTP/2.0" 301 194 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0"
show less
Bad Web Bot
Web App Attack
2026-05-25 11:00:41
UTC ·
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇮🇩
securejdprop
2026-05-25 10:58:48
UTC ·
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access. WAF block: crowdsecurity/vpatch-env-access from 54.210.148.167 (172.18.0.2)
Hacking
Web App Attack
🇮🇪
AutosOnShow
2026-05-25 10:52:04
UTC ·
(5 months ago)
blocked for webapp attack | path requested: /.env | seen at 2026-05-25 10:51:13.384 |
Web App Attack
🇫🇮
inlink.ltd
2026-05-25 10:49:03
UTC ·
(5 months ago)
dot file probe
Web App Attack
🇧🇪
cmbplf
2026-05-25 10:35:43
UTC ·
(5 months ago)
1.422 requests with url.path *.env
Brute-Force
Bad Web Bot
🇩🇪
MusicLibrary
2026-05-25 10:10:02
UTC ·
(5 months ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-05-25 10:09:58
UTC ·
(5 months ago)
2026/05/25 10:09:57 [error] 3575124#3575124: *255022864 access forbidden by rule, client: 54.210.148.167, server: binixo.co, request: "GET /.env HTTP/1.1", host: "binixo.co"
2026/05/25 10:09:57 [error] 3575124#3575124: *255022864 access forbidden by ...
show more
2026/05/25 10:09:57 [error] 3575124#3575124: *255022864 access forbidden by rule, client: 54.210.148.167, server: binixo.co, request: "GET /.env HTTP/1.1", host: "binixo.co"
2026/05/25 10:09:57 [error] 3575124#3575124: *255022864 access forbidden by rule, client: 54.210.148.167, server: binixo.co, request: "GET /.env.bak HTTP/1.1", host: "binixo.co"
2026/05/25 10:09:57 [error] 3575124#3575124: *255022864 access forbidden by rule, client: 54.210.148.167, server: binixo.co, request: "GET /.env.old HTTP/1.1", host: "binixo.co"
...
show less
Web App Attack
🇪🇸
pipeline.es
2026-05-25 10:07:01
UTC ·
(5 months ago)
Web scanning / probing for vulnerable paths | URL: /public/.env | Evidence: onlinetours.es 54.210.148.167 - - [25/May/2026:12:05:25 +0200] \"GET /public/.env HTTP/1.1\" 404 51490 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K ...
show more
Web scanning / probing for vulnerable paths | URL: /public/.env | Evidence: onlinetours.es 54.210.148.167 - - [25/May/2026:12:05:25 +0200] \"GET /public/.env HTTP/1.1\" 404 51490 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0\" GEOIP_COUNTRY_CODE=US | ASN: AMAZON-AES | Country: US
show less
Port Scan
Web App Attack
2026-05-25 10:06:48
UTC ·
(5 months ago)
Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=80
Hacking
🇺🇸
TPI-Abuse
2026-05-25 10:05:51
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 54.210.148.167 (ec2-54-210-148-167.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:05:48.016604 2026] [security2:error] [pid 958:t ...
show more
(mod_security) mod_security (id:210492) triggered by 54.210.148.167 (ec2-54-210-148-167.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:05:48.016604 2026] [security2:error] [pid 958:tid 958] [client 54.210.148.167:60396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flavornet.org"] [uri "/.env"] [unique_id "ahQe_Gmqyudljj70EkiiBAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-05-25 10:05:30
UTC ·
(5 months ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-05-25 09:59:42
UTC ·
(5 months ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
e.fierstra
2026-05-25 09:58:54
UTC ·
(5 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 09:45:43
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 54.210.148.167 (ec2-54-210-148-167.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 05:45:36.454827 2026] [security2:error] [pid 5221: ...
show more
(mod_security) mod_security (id:210492) triggered by 54.210.148.167 (ec2-54-210-148-167.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 05:45:36.454827 2026] [security2:error] [pid 5221:tid 5221] [client 54.210.148.167:64742] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "compassionfatigue.org"] [uri "/.env"] [unique_id "ahQaQLl-MBaf1l_lgFScmgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack