🇺🇸
Sylvyon
2026-04-26 13:47:41
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
interbiznw.com
2026-04-26 13:42:42
(1 month ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 13:40:49
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 09:40:41.244762 2026] [security2:error] [pid 9619:tid 9619] [client 181.215.182.171:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perl-photo.com"] [uri "/.env"] [unique_id "ae4V2SghP9vS_hqO9nSeywAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
betternews.app
2026-04-26 13:30:07
(1 month ago)
"a web request contained keyword ".env"; Suspicious URL: /.env"
Web Spam
Blog Spam
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-04-26 13:29:49
(1 month ago)
Scanning for exploits - /.env
Web App Attack
🇧🇷
Halux
2026-04-26 13:22:37
(1 month ago)
181.215.182.171 Probing protected path or service
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 12:56:37
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 08:56:29.350919 2026] [security2:error] [pid 11248:tid 11248] [client 181.215.182.171:2809] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rivendells.com"] [uri "/.env"] [unique_id "ae4LfadFW8zMdd9HHyZFwgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-04-26 12:42:47
(1 month ago)
Multiple WAF Violations
Web App Attack
🇪🇸
el-brujo
2026-04-26 12:33:15
(1 month ago)
Cloudflare WAF: Request Path: /.env Request Query: Host: elhacker.net userAgent: Mozilla/5.0 (Macin ...
show more
Cloudflare WAF: Request Path: /.env Request Query: Host: elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 Action: block Source: firewallManaged ASN Description: Cogent Communications, LLC Country: US Method: GET Timestamp: 2026-04-26T12:33:15Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇵🇾
armandosaucedo.me
2026-04-26 12:29:47
(1 month ago)
Threat Intelligence via ARMTI, Web Attack: GET /.env
Web App Attack
🇺🇸
wordpresshosting.solutions
2026-04-26 12:26:01
(1 month ago)
Web app vulnerability scanning detected. Evidence: 181.215.182.171 - - [26/Apr/2026:12:19:48 +0000] ...
show more
Web app vulnerability scanning detected. Evidence: 181.215.182.171 - - [26/Apr/2026:12:19:48 +0000] "GET /.env HTTP/1.1" 404 44805 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
181.215.182.171 - - [26/Apr/2026:12:26:01 +0000] "GET /.env HTTP/1.1" 404 39682 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
🇩🇪
ISPLtd
2026-04-26 12:25:09
(1 month ago)
181.215.182.171 [26/Apr/2026:09:25:02 -0300] target.domain.ca:443 URL:/.env "GET /.env
181.215.182.1 ...
show more
181.215.182.171 [26/Apr/2026:09:25:02 -0300] target.domain.ca:443 URL:/.env "GET /.env
181.215.182.171 [26/Apr/2026:09:25:08 -0300] target.domain.com:443 URL:/.env "GET /.env
...
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-04-26 11:53:04
(1 month ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 11:52:20
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 07:52:14.029646 2026] [security2:error] [pid 31718:tid 31718] [client 181.215.182.171:16764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "golf-4-good.com"] [uri "/.env"] [unique_id "ae38bkU_9y_reeKBRePLrgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-04-26 11:47:33
(1 month ago)
IM360 WAF: Laravel .env file access
Web App Attack