Maximum Danger
IP 78.153.140.224 is a critical-risk address operated through Hostglobal.plus Ltd in the United Kingdom that has been systematically scanning web servers for exposed environment configuration files, amassing 904 abuse reports across a seven-month period from August 2025 through February 2026. The associated ASN, AS202306, sits behind this persistent probing activity that warrants immediate blocking by any exposed service.
Automated honeypot sensors across 15 detection points and 5 community sources logged this activity, documenting 20 specific threat events split between Hacking (14) and Web App Attack (6) categorisations. Despite a threat level rated 10 out of 10, the activity frequency registers at 0 out of 10, indicating that the observed attacks occur in distinct campaigns rather than continuous traffic — this attacker strikes in concentrated bursts followed by silent intervals, suggesting coordinated or scripted operations. The 904 total reports spanning multiple months across a modest 20 specific event categorisations points to a focused, methodical scanner rather than a noisy opportunistic actor.
The attack patterns reveal systematic vulnerability scanning targeting NGINX-served applications, with the IP repeatedly probing for .env files across predictable directory structures including /api/, /admin/, /backend/, /migrations/, and /media/. These environment configuration files typically store database credentials, API keys, secret tokens, and authentication parameters — compromise of such files effectively grants an attacker the keys to the entire application stack. The scanning also included attempts on /.env.mailer_url and /.env-test-stage, demonstrating knowledge of common development-stage misconfigurations. This reconnaissance activity precedes actual exploitation; the actor is identifying misconfigured servers that may expose sensitive credentials for subsequent abuse.
Site operators should immediately block this IP at the firewall or load balancer level, implement fail2ban or equivalent log-based blocking to auto-respond to repeated scanning behaviour, and configure web servers to return 403 Forbidden for any direct .env file access rather than serving the files. Deploying a web application firewall with rules specifically targeting path traversal and sensitive file enumeration attempts provides an additional defensive layer. Regular security audits should verify that environment files reside outside web-accessible directories and that automated deployment pipelines do not inadvertently expose these configuration assets during development or staging processes.
SC 
HK