🇩🇪
Grossmann-Gruppe
2026-09-01 11:01:00
(44 minutes ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-09-01 10:56:57
(48 minutes ago)
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:56:51.130226 2026] [security2:error] [pid 26576:tid 26576] [client 104.196.0.82:59798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.behrooz.org"] [uri "/.env"] [unique_id "apavc8Nct8rEYCqwIOw-GgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-01 09:58:22
(1 hour ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
thesimonmanuel
2026-09-01 09:45:27
(1 hour ago)
104.196.0.82 - - [01/Sep/2026:15:15:27 +0530] "GET /.env.prod HTTP/2.0" 404 146 "-" "crusader-worker ...
show more
104.196.0.82 - - [01/Sep/2026:15:15:27 +0530] "GET /.env.prod HTTP/2.0" 404 146 "-" "crusader-worker/1.0" "104.196.0.82"
show less
Web App Attack
🇫🇷
spot
2026-09-01 09:29:35
(2 hours ago)
104.196.0.82 - - [01/Sep/2026:10:29:34 +0100] "GET /.env.prod HTTP/1.1" 404 4656 "-" "crusader-worke ...
show more
104.196.0.82 - - [01/Sep/2026:10:29:34 +0100] "GET /.env.prod HTTP/1.1" 404 4656 "-" "crusader-worker/1.0"
...
show less
Web App Attack
VPN IP
🇺🇸
TPI-Abuse
2026-09-01 09:13:22
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:13:14.538411 2026] [security2:error] [pid 14202:tid 14202] [client 104.196.0.82:37582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "taller.verdeprofundo.net"] [uri "/.env.example"] [unique_id "apaXKhuwG2c77kYVw8zifQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-01 08:47:03
(2 hours ago)
Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1, GET /.env.save HTTP/1.1
Hacking
Web App Attack
🇬🇧
poundawebsiteltd
2026-09-01 07:52:29
(3 hours ago)
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 104.196.0. ...
show more
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 104.196.0.82 (US/United States/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 104.196.0.82 (US/United States/82.0.196.104.bc.googleusercontent.com): 20 in the last 3600 secs
show less
Brute-Force
Web App Attack
2026-09-01 07:51:50
(3 hours ago)
[server.tmg.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.env.backup | /.env.exam ...
show more
[server.tmg.gr] httpd-config-scan: logs=/var/log/httpd/access_log; samples=/.env.backup | /.env.example | /wp-config.php.bak
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 07:03:04
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 104.196.0.82 (82.0.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:02:59.350043 2026] [security2:error] [pid 10689:tid 10689] [client 104.196.0.82:34220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fashionmenswear.com"] [uri "/.env.backup"] [unique_id "apZ4o2GmXho-HB4JZ1PzkgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-09-01 06:59:01
(4 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-01 06:49:55
(4 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
LRob
2026-09-01 06:41:17
(5 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.old (+12 more) | 2026-09-01 06:41 UTC
show less
Hacking
Web App Attack
2026-09-01 05:27:49
(6 hours ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
2026-09-01 04:24:55
(7 hours ago)
Web scanner: GET /.env.backup
Web App Attack
Hacking