2026-06-08 12:44:57
(2 months ago)
(caddyscan) Scanner path probe from 72.60.183.52 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 72.60.183.52 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 72.60.183.52 - - [08/Jun/2026:12:44:54 +0000] "GET /.env.save HTTP/1.1"
[REDACTED] 200 2627 72.60.183.52 - - [08/Jun/2026:12:44:54 +0000] "GET /api/.env HTTP/1.1"
[REDACTED] 200 2627 72.60.183.52 - - [08/Jun/2026:12:44:54 +0000] "GET /dev/.env HTTP/1.1"
[REDACTED] 200 2627 72.60.183.52 - - [08/Jun/2026:12:44:54 +0000] "GET /admin/.env HTTP/1.1"
[REDACTED] 200 2627 72.60.183.52 - - [08/Jun/2026:12:44:54 +0000] "GET /api/.env.save HTTP/1.1"
show less
Port Scan
🇨🇦
electronico
2026-06-08 12:18:48
(2 months ago)
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /api/.env.save HTTP/1.1" 404 5858 "-" "Mozilla/5. ...
show more
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /api/.env.save HTTP/1.1" 404 5858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /app/.env HTTP/1.1" 404 5858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /api/.env HTTP/1.1" 404 5858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /core/.env.save HTTP/1.1" 404 5858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
72.60.183.52 - - [08/Jun/2026:23:18:47 +1100] "GET /laravel/.env HTTP/1.1" 404 5858 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 09:11:29
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:11:24.480166 2026] [security2:error] [pid 5666:tid 5666] [client 72.60.183.52:48972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flashbackmusicmemories.com"] [uri "/dev/.env"] [unique_id "aiaHPNBRYuSAY0Oxk16QsAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 07:49:02
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 03:48:54.801074 2026] [security2:error] [pid 12240:tid 12240] [client 72.60.183.52:57364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weddingfavorcandles.com"] [uri "/core/.env.save"] [unique_id "aiZz5mfQo7_sCkMkTH-sbwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 07:24:41
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 03:24:33.248034 2026] [security2:error] [pid 31384:tid 31411] [client 72.60.183.52:56814] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "draas.info"] [uri "/core/.env"] [unique_id "aiZuMYG8O8RGM4iw8GnTNgAAAJg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
P1n4
2026-06-08 06:32:35
(2 months ago)
Heimdal IDS auto-block: sensitive_file (score=1.00)
Web App Attack
🇷🇺
DZBOT
2026-06-08 06:04:16
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
2026-06-08 04:11:04
(2 months ago)
Bot / scanning and/or hacking attempts: GET /backend/.env HTTP/1.1, GET /laravel/.env HTTP/1.1, GET ...
show more
Bot / scanning and/or hacking attempts: GET /backend/.env HTTP/1.1, GET /laravel/.env HTTP/1.1, GET /.env.save HTTP/1.1, GET /app/.env HTTP/1.1, GET /dev/.env HTTP/1.1, GET /.env HTTP/1.1, GET /api/.env.save HTTP/1.1, GET /core/.env.save HTTP/1.1, GET /core/.env HTTP/1.1, GET /members/.env HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
SwinT
2026-06-08 02:00:05
(2 months ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 01:37:23
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 21:37:16.536736 2026] [security2:error] [pid 19302:tid 19302] [client 72.60.183.52:40612] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "birdlovers.net"] [uri "/.env"] [unique_id "aiYczClgv14_46KQs_jTlAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-08 00:05:36
(2 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇫🇷
dynamix
2026-06-08 00:00:13
(2 months ago)
Multiple WAF Violations
Web App Attack
🇳🇱
wlt-blocker
2026-06-07 23:01:49
(2 months ago)
Unauthorized access to webpage admin
Web App Attack
2026-06-07 22:30:02
(2 months ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 22:22:14
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 72.60.183.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 18:22:06.944269 2026] [security2:error] [pid 15550:tid 15550] [client 72.60.183.52:31536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caferutadelaseda.com"] [uri "/api/.env.save"] [unique_id "aiXvDgO1iMeo8AwaHHo2pgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack