Critical Alert
IP 78.153.140.179 is a maximum-threat (10/10) address tied to sustained vulnerability scanning activity, accumulating 1,957 independent abuse reports across automated honeypot sensors and community sources between August 2025 and January 2026, with all recent reports classifying the activity as general hacking and web application attacks. The IP originates from the United Kingdom and is registered to Hostglobal.plus Ltd, making this a commercially hosted source rather than a typical residential bot. While the confidence score of 61% reflects inherent uncertainty in attributing all activity to the same actor, the sheer volume of reports across 20 distinct sources over five months demonstrates persistent, automated reconnaissance rather than isolated probes.
The attack patterns observed in honeypot logs reveal systematic enumeration of web server configurations, with the attacker repeatedly requesting paths associated with environment configuration files (.env), development directories (/dev/), and application-specific subdirectories. Requests target /.env, /api/.env, /admin/.env, /backend/.env, /lambda/.env, /nodeapi/.env, /nodeweb/.env, and similar variations across multiple frameworks including Angular and Node.js stacks. Additional probes include /.env_storage, /.env_workers, /.env-systemd, and generic script scanning against root paths, indicating a broad automated scanner designed to identify misconfigured deployments across diverse technology stacks.
Environment files represent one of the highest-risk targets in web application security because they conventionally store database credentials, API keys, encryption secrets, and service tokens in plaintext. A successful retrieval of these files could provide immediate privileged access to backend databases, payment processors, cloud services, or third-party APIs without requiring further exploitation. The systematic, path-diverse scanning approach suggests the attacker operates a mature reconnaissance tool capable of adapting probes to detected application fingerprints, increasing the likelihood of finding at least one misconfigured endpoint in any large-scale deployment.
RO 
JP 
HK