🇺🇸
TPI-Abuse
2026-06-05 04:29:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 00:29:48.795967 2026] [security2:error] [pid 32654:tid 32654] [client 102.98.77.241:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "betiqos.com"] [uri "/.env"] [unique_id "aiJQvOUD1OfrQvcYapm6zgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jkcunningham
2026-06-05 00:45:30
(2 days ago)
Vulnerability scanner. Targets os and filesystem.
Bad Web Bot
Port Scan
🇨🇭
4server
2026-06-04 04:21:43
(3 days ago)
[ThuJun0406:21:36.2301892026][security2:error][pid2361262:tid2361531][client102.98.77.241:0]ModSecur ...
show more
[ThuJun0406:21:36.2301892026][security2:error][pid2361262:tid2361531][client102.98.77.241:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"gipfelbild.com\"][uri\"/.env\"][unique_id\"aiD9ULo_-o5TGv8_JaqZbwAAANA\"]
show less
Hacking
Web App Attack
🇱🇻
garmtech.com
2026-06-04 02:29:07
(3 days ago)
IM360 WAF: Direct access to sensitive file or dotfile MV:/.env
Web App Attack
2026-06-04 01:20:01
(3 days ago)
suspicious request in access.log
Web App Attack
🇺🇸
interbiznw.com
2026-06-04 01:03:27
(3 days ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 00:58:09
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 20:58:03.332694 2026] [security2:error] [pid 9823:tid 9823] [client 102.98.77.241:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "totalsafe-security.com"] [uri "/.env"] [unique_id "aiDNmzTbMqDfH4a2LPmsEgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
Halux
2026-06-03 23:32:53
(3 days ago)
102.98.77.241 Probing protected path or service
Web App Attack
🇵🇾
armandosaucedo.me
2026-06-03 15:05:13
(3 days ago)
Threat Intelligence via ARMTI, Web Attack: GET /.env
Web App Attack
🇺🇸
lnklnx
2026-06-03 10:41:02
(3 days ago)
www.rcmeal.com:80 102.98.77.241 - - [03/Jun/2026:05:40:59 -0500] "GET /.env HTTP/1.1" 301 615 "-" "M ...
show more
www.rcmeal.com:80 102.98.77.241 - - [03/Jun/2026:05:40:59 -0500] "GET /.env HTTP/1.1" 301 615 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Web App Attack
🇬🇧
Axel
2026-06-03 10:06:01
(3 days ago)
Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.env Server: ...
show more
Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.env Server: UK-01
show less
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-06-03 08:41:29
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 04:41:25.985960 2026] [security2:error] [pid 1880:tid 1880] [client 102.98.77.241:53217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "graciousholding.com"] [uri "/.env"] [unique_id "ah_otQ0942R9O-YbLNOx_AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-06-03 05:59:22
(4 days ago)
Probing websites for vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 05:24:44
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:24:36.287929 2026] [security2:error] [pid 15547:tid 15547] [client 102.98.77.241:50663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "raritymountainadventures.com"] [uri "/.env"] [unique_id "ah-6lKJV0FcI9E9pP0AXBQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-03 02:04:39
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 102.98.77.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 22:04:33.024321 2026] [security2:error] [pid 27484:tid 27484] [client 102.98.77.241:58269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "d365geek.com"] [uri "/.env"] [unique_id "ah-LsXMKxFYFdoH9eZFMvAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack