🇫🇷
masterguru
2026-10-15 08:11:38
(2 weeks ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
2026-10-12 07:50:03
(2 weeks ago)
Bot / scanning and/or hacking attempts: GET /backend/.aws/credentials HTTP/1.1, GET /configuration.php HTTP/1.1, GET /api/config.php HTTP/1.1, GET /config/.env HTTP/1.1, GET /api/config.json HTTP/1.1, GET /admin/wp-config.php HTTP/1.1, GET /admin/.en ...
show more
Bot / scanning and/or hacking attempts: GET /backend/.aws/credentials HTTP/1.1, GET /configuration.php HTTP/1.1, GET /api/config.php HTTP/1.1, GET /config/.env HTTP/1.1, GET /api/config.json HTTP/1.1, GET /admin/wp-config.php HTTP/1.1, GET /admin/.env HTTP/1.1, GET /config/config.json HTTP/1.1, GET /wp-config.php HTTP/1.1, GET /database.yml HTTP/1.1, GET /config/config.php HTTP/1.1, GET /config/.aws/credentials HTTP/1.1, GET /backend/.env HTTP/1.1, GET /config.php HTTP/1.1, GET /api/.env HTTP/1.1, GET /admin/.aws/credentials HTTP/1.1, GET /settings.php HTTP/1.1, GET /api/wp-config.php HTTP/1.1, GET /backend/config.php HTTP/1.1, GET /config/wp-config.php HTTP/1.1, GET /api/.aws/credentials HTTP/1.1, GET /backend/config.json HTTP/1.1, GET /admin/config.json HTTP/1.1, GET /credentials.json HTTP/1.1, GET /admin/config.php HTTP/1.1, GET /backend/wp-config.php HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
eposs-it.de
2026-10-09 03:20:11
(3 weeks ago)
Blocked by os-abuseipdb; 11 hits, proto=tcp, ports=80
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-10-09 01:24:26
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:24:21.031811 2026] [security2:error] [pid 7641:tid 7641] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:24:21.031811 2026] [security2:error] [pid 7641:tid 7641] [client 169.58.107.207:54192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "partyfavorsonline.com"] [uri "/administrator/config/.env"] [unique_id "ashCRflfUj06yjLZ3ZHpJQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:08:43
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:08:40.063179 2026] [security2:error] [pid 12924:tid 12924] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:08:40.063179 2026] [security2:error] [pid 12924:tid 12924] [client 169.58.107.207:54124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "summithost.com"] [uri "/store/.env"] [unique_id "asg-mPU3uz17Lf_3Zy5ABAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 00:50:07
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:50:00.222370 2026] [security2:error] [pid 19031:tid 19031] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:50:00.222370 2026] [security2:error] [pid 19031:tid 19031] [client 169.58.107.207:53420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bankcardtexas.com"] [uri "/shop/.env"] [unique_id "asg6OFN0RLAypmXbR93ZUQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 00:04:34
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:04:26.391783 2026] [security2:error] [pid 10770:tid 10770] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:04:26.391783 2026] [security2:error] [pid 10770:tid 10770] [client 169.58.107.207:42246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tablerockfriends.com"] [uri "/.env"] [unique_id "asgvivpdaZZtuuh-5zywGAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ConsulHosting
2026-10-08 23:42:31
(3 weeks ago)
Automatically blocked due to distributed attack
Hacking
🇺🇸
TPI-Abuse
2026-10-08 23:35:50
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:35:42.300725 2026] [security2:error] [pid 28040:tid 28040] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:35:42.300725 2026] [security2:error] [pid 28040:tid 28040] [client 169.58.107.207:39342] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fanarch.xyz"] [uri "/api/v1/.env"] [unique_id "asgozoBEZYfpiFQPuqXZAgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-08 21:44:47
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-08 21:43:51
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 17:43:47.993444 2026] [security2:error] [pid 26909:tid 26909] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 17:43:47.993444 2026] [security2:error] [pid 26909:tid 26909] [client 169.58.107.207:42602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garyrankin.com"] [uri "/sql/.env"] [unique_id "asgOkz5p2cchRG2CcjkdcwAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 21:28:20
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 17:28:12.594380 2026] [security2:error] [pid 29134:tid 29134] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 17:28:12.594380 2026] [security2:error] [pid 29134:tid 29134] [client 169.58.107.207:41218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rkhindustries.com"] [uri "/testing/.env"] [unique_id "asgK7NM0mVvcA95t9Ph2DAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 20:59:50
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:59:42.790734 2026] [security2:error] [pid 21985:tid 21985] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:59:42.790734 2026] [security2:error] [pid 21985:tid 21985] [client 169.58.107.207:53150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wendywonjungkim.com"] [uri "/old/.env"] [unique_id "asgEPjpT1stqrZxD92gXHwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 02:43:45
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 22:43:38.589280 2026] [security2:error] [pid 9120:tid 9120] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 169.58.107.207 (vmi3478842.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 22:43:38.589280 2026] [security2:error] [pid 9120:tid 9120] [client 169.58.107.207:52304] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rosawallas.com"] [uri "/api/test/.env"] [unique_id "ascDWjXvRjVC6DFqgx_ZAgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-07 22:05:38
(3 weeks ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (113/60 min)'; Requests=113
Port Scan
