(mod_security) mod_security (id:210492) triggered by 147.90.209.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 01:12:29.228998 2026] [security2:error] [pid 25226:tid 25226] [client 147.90.209.63:43585] M ...
show more(mod_security) mod_security (id:210492) triggered by 147.90.209.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 01:12:29.228998 2026] [security2:error] [pid 25226:tid 25226] [client 147.90.209.63:43585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.46"] [uri "/.env"] [unique_id "arNfvS2uKjlvFdkK_vH81gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Automated web attack from 147.90.209.63 against our web server.
1 malicious request on 2026-09-23 (UTC), denied with HTTP 403.
Classified as: attempted retrieval of .env files.
The request specified the server IP address rather than a hostname.
Sampl ...
show moreAutomated web attack from 147.90.209.63 against our web server.
1 malicious request on 2026-09-23 (UTC), denied with HTTP 403.
Classified as: attempted retrieval of .env files.
The request specified the server IP address rather than a hostname.
Sample request: GET /.env
Probed for: exposed .env files.
User-Agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36".
AS212238 CDNEXT.
One of 32 hosts sending a byte-identical User-Agent to us; 340 of the 496 host pairs among them requested at least one identical path. From this address: /.env.
This host presented a browser User-Agent but did not load the image or the script referenced by the returned page, which a browser would have fetched automatically.
All timestamps are UTC.
show less
