2026-11-05 16:32:47
UTC ·
(4 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇿🇦
conure.sh
2026-11-05 12:05:27
UTC ·
(4 days ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x2; 1 domain(s) in 5s
Web App Attack
🇩🇪
altenglaner
2026-11-04 22:59:48
UTC ·
(5 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 22:42:24
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:42:19.912216 2026] [security2:error] [pid 14540:tid 14540] [client 102.89.76.128:46401] M ...
show more
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:42:19.912216 2026] [security2:error] [pid 14540:tid 14540] [client 102.89.76.128:46401] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sarahpeebles.net"] [uri "/.env"] [unique_id "auu0ywI4d9dexBc3S-QoWAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 22:13:37
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:13:33.450108 2026] [security2:error] [pid 2154:tid 2154] [client 102.89.76.128:50888] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:13:33.450108 2026] [security2:error] [pid 2154:tid 2154] [client 102.89.76.128:50888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dogarttoday.com"] [uri "/.env"] [unique_id "auuuDVybBs6QFY45L0MYvgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
bohl-aiG5aef
2026-11-04 22:05:17
UTC ·
(5 days ago)
Suricata Alert [SID:2031502] ET INFO Request to Hidden Environment File - Inbound
Hacking
🇨🇭
lufi
2026-11-04 22:01:36
UTC ·
(5 days ago)
2026-11-04T23:01:36+01:00 lufischer04 ids442 2026-11-04 23:01:36 102.89.76.128: blacklistedPath: /.env
...
Web Spam
Brute-Force
Hacking
Web App Attack
2026-11-04 22:00:04
UTC ·
(5 days ago)
[ns19.kdns.gr] httpd-config-scan: sites=www.t-support.gr; logs=/var/log/httpd/domains/t-support.gr.log; samples=/.env
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 21:49:39
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 16:49:32.830617 2026] [security2:error] [pid 21194:tid 21194] [client 102.89.76.128:28315] M ...
show more
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 16:49:32.830617 2026] [security2:error] [pid 21194:tid 21194] [client 102.89.76.128:28315] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.texaschristmascards.com"] [uri "/.env"] [unique_id "auuobKPRYNJ72ocNzrei5AAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-11-04 21:07:03
UTC ·
(5 days ago)
Accessed trap at '/.env'
Web App Attack
🇺🇸
Lee Daniel
2026-11-04 20:59:09
UTC ·
(5 days ago)
102.89.76.128 - - [04/Nov/2026:15:59:08 -0500] "GET /.env HTTP/1.1" 403 344 "-" "Mozilla/5.0 (Android 16; Mobile; rv:148.0) Gecko/148.0 Firefox/148.0"
...
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kp_5036
2026-11-04 20:37:11
UTC ·
(5 days ago)
Cloudflare WAF 2026-11-04 19:32 - 2026-11-04 20:37 UTC, 1 requests: probed /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa
Hacking
Web App Attack
2026-11-04 20:03:01
UTC ·
(5 days ago)
[Firewall Canary] Temporary ban due to firewall rule match [URI:*/.env]
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-04 19:36:57
UTC ·
(5 days ago)
[Thu Nov 05 06:36:56.087510 2026] [security2:error] [pid 426465] [client 102.89.76.128:57095] [client 102.89.76.128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Thu Nov 05 06:36:56.087510 2026] [security2:error] [pid 426465] [client 102.89.76.128:57095] [client 102.89.76.128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/.env"] [unique_id "auuJWA3rVVz_NFW_cwP_kgAAACU"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 19:31:37
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:31:29.724473 2026] [security2:error] [pid 16210:tid 16210] [client 102.89.76.128:22229] M ...
show more
(mod_security) mod_security (id:210492) triggered by 102.89.76.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:31:29.724473 2026] [security2:error] [pid 16210:tid 16210] [client 102.89.76.128:22229] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "socialstudiesforkids.com"] [uri "/.env"] [unique_id "auuIEQQ965hkcVB4ZE7I4AAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
