🇺🇦
URAN Publishing Service
2026-09-03 15:51:18
(3 hours ago)
[03/Sep/2026:18:51:18 +0300] -- 102.209.31.131 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[03/Sep/2026:18:51:18 +0300] -- 102.209.31.131 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-02 22:01:24
(21 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-01.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-02 10:06:43
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 06:06:36.685985 2026] [security2:error] [pid 5859:tid 5859] [client 102.209.31.131:57412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.legalnexuslawfirm.com"] [uri "/.env"] [unique_id "apf1LMDAWDNOwrj1MBsEBgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 09:49:03
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 05:48:55.063456 2026] [security2:error] [pid 28023:tid 28023] [client 102.209.31.131:60630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.timetemple.org"] [uri "/.env"] [unique_id "apfxB5TD5n7jMYTOzPMh4gAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 09:23:54
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 05:23:48.699333 2026] [security2:error] [pid 3226825:tid 3227016] [client 102.209.31.131:59151] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fishrapper.com"] [uri "/.env"] [unique_id "apfrJOs1UIk8zkouoRW1bQAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-02 09:21:03
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env HTTP/2.0
Hacking
Web App Attack
🇮🇪
Jim Keir
2026-09-02 08:57:31
(1 day ago)
2026-09-02 08:57:31 102.209.31.131 File scanning, blocking 102.209.31.131 for 5 minutes
Web App Attack
🇭🇺
bcsaba
2026-09-02 08:50:42
(1 day ago)
Probing for .env file:
102.209.31.131 - - [02/Sep/2026:10:50:38 +0200] "GET /.env HTTP/2.0" 403 146 ...
show more
Probing for .env file:
102.209.31.131 - - [02/Sep/2026:10:50:38 +0200] "GET /.env HTTP/2.0" 403 146 "-" "Mozilla/5.0 (Android 16; Mobile; rv:148.0) Gecko/148.0 Firefox/148.0"
show less
Web App Attack
2026-09-01 19:03:05
(2 days ago)
"GET /.env HTTP/1.1"
Hacking
Web App Attack
🇳🇱
enpepet
2026-09-01 11:13:16
(2 days ago)
GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Android 16; Mobile; rv:148.0) Gecko/148.0 Firefox/14 ...
show more
GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Android 16; Mobile; rv:148.0) Gecko/148.0 Firefox/148.0 URL:/.env
show less
Port Scan
Hacking
Brute-Force
Bad Web Bot
🇺🇦
URAN Publishing Service
2026-09-01 11:00:35
(2 days ago)
[01/Sep/2026:14:00:34 +0300] -- 102.209.31.131 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[01/Sep/2026:14:00:34 +0300] -- 102.209.31.131 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 10:52:41
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:52:36.977505 2026] [security2:error] [pid 22844:tid 22844] [client 102.209.31.131:55308] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "truecontrarian.com"] [uri "/.env"] [unique_id "apaudBJqv806yZI76Y0mMgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 10:18:59
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:18:52.512413 2026] [security2:error] [pid 29998:tid 29998] [client 102.209.31.131:63262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "modmove.com"] [uri "/.env"] [unique_id "apamjBCsPePBxJ8TghjLzAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-09-01 10:09:11
(2 days ago)
[Tue Sep 01 20:09:10.638112 2026] [security2:error] [pid 240008] [client 102.209.31.131:63857] [clie ...
show more
[Tue Sep 01 20:09:10.638112 2026] [security2:error] [pid 240008] [client 102.209.31.131:63857] [client 102.209.31.131] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/.env"] [unique_id "apakRhddskNl8pOWYrrOVgAAAAs"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 10:00:19
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 102.209.31.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:00:13.186907 2026] [security2:error] [pid 29738:tid 29890] [client 102.209.31.131:49748] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "certifiedeconomist.com"] [uri "/.env"] [unique_id "apaiLQPlJnWS0sb9P1-oNQAAAU4"]
show less
Brute-Force
Bad Web Bot
Web App Attack