Critical Threat
IP 78.153.140.203 is a critical-risk address associated with sustained vulnerability scanning activity targeting web application configuration files, accumulating over 1,200 abuse reports across a six-month observation window. Hosted within the Hostglobal.plus Ltd network (AS202306) and geolocated to the United Kingdom, this IP has been flagged by both automated honeypot sensors and community reports since August 2025, with the most recent confirmed reports arriving in February 2026. Despite a moderate confidence score of 61 percent, the sheer volume of reports and a maximum threat-level rating firmly establish this address as a persistent threat actor worth blocking on sight.
The detection data reveals a concentrated pattern of automated reconnaissance. Logs extracted from honeypot events show repeated scanning probes targeting sensitive application paths including /.env, /admin/.env, /api/.env, and /app/.env — all attempting to locate exposed environment configuration files that frequently contain database credentials, API tokens, and cryptographic secrets. Of the 1,250 total reports, 15 distinct automated honeypot sensors and 5 independent community sources contributed data, lending credibility to the assessment. The dual threat categories of Hacking (12 reports) and Web App Attack (8 reports) align precisely with the observed scanning behavior, indicating a structured, methodical campaign rather than opportunistic noise.
Web application vulnerability scanning of this nature poses a concrete and significant risk to any exposed service. Environment files are a standard attack vector because a single successful retrieval can yield plaintext secrets granting database access, third-party API control, or even server-side code execution. Attackers weaponise these credentials for data exfiltration, account takeover, or lateral movement within a network. The probing pattern observed here — systematically enumerating common application directories — is a low-cost, high-reward reconnaissance step that almost always precedes more targeted exploitation attempts. organisations running outdated or misconfigured web applications are particularly vulnerable to follow-on attacks if initial scans succeed undetected.
Site operators should treat this IP address as explicitly hostile. Deploying a web application firewall with rule sets tuned to block directory traversal and sensitive file access attempts offers immediate protection. Ensuring that .env files and other configuration artifacts are placed entirely outside the web root and are inaccessible via HTTP removes the primary target of this scanning campaign. Implementing fail2ban or equivalent dynamic blocking on systems receiving these probes will automate the mitigation loop. Finally, maintaining an active IP reputation feed and auditing application logs for requests matching the observed URI patterns will help detect any successful reconnaissance before it escalates into a breach.
RO 
JP 
HK