2026-02-15 12:35:21
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
TPI-Abuse
2026-02-15 12:34:16
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:34:10.822045 2026] [security2:error] [pid 786850:tid 786853] [client 104.207.47.130:31795] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "quetzalcoatl2012.net"] [uri "/frontend/.env"] [unique_id "aZG9Qul4D30lxioNoxLmOgAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 11:30:43
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:30:36.502486 2026] [security2:error] [pid 20172:tid 20172] [client 104.207.47.130:63977] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ozarkshousing.com"] [uri "/admin/.git/config"] [unique_id "aZGuXGaP8UUxGJtAv6r2ngAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 07:02:44
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 02:02:37.339868 2026] [security2:error] [pid 12209:tid 12209] [client 104.207.47.130:49881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "seatbeltstatistics.org"] [uri "/backend/.env"] [unique_id "aZFvjXsi2Qn0JRlW7u3rCQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 06:20:35
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 01:20:28.646174 2026] [security2:error] [pid 25249:tid 25249] [client 104.207.47.130:21263] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "onlineteacher.info"] [uri "/new/.git/config"] [unique_id "aZFlrJZW3H0adBImOpMTzwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-02-15 06:01:48
(4 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.47.130 (US/United States/-) ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.47.130 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 05:58:27
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:58:22.685938 2026] [security2:error] [pid 28203:tid 28203] [client 104.207.47.130:61977] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "omnithermal.com"] [uri "/config/.env"] [unique_id "aZFgfjtT4dr29mq9Z-YjfwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-15 05:18:24
(4 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-02-15 05:17:20
(4 months ago)
Try to access /.env
Web App Attack
🇺🇸
OceanTreasure
2026-02-15 05:15:34
(4 months ago)
tcp/443; Git configuration exposure attempt: "GET /api/.git/config" @ 2026-02-15T05:06:07Z [proxy]
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 05:12:14
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:12:09.167376 2026] [security2:error] [pid 10935:tid 10935] [client 104.207.47.130:50475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "odessatexas.us"] [uri "/api/.git/config"] [unique_id "aZFVqbgldt3aqp9FOAzUhQAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 04:48:37
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:48:29.796475 2026] [security2:error] [pid 9763:tid 9763] [client 104.207.47.130:51627] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sanvayu.com"] [uri "/.env.staging"] [unique_id "aZFQHV8ql0Ou5ytGfmYNjgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 04:06:35
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:06:28.745563 2026] [security2:error] [pid 14709:tid 14709] [client 104.207.47.130:56829] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "powdercoatovens.net"] [uri "/api/.git/config"] [unique_id "aZFGREE5z9QTdrdW0CJ_TAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 03:42:11
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 22:42:04.350037 2026] [security2:error] [pid 1269975:tid 1269975] [client 104.207.47.130:46081] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sailorbandido.com"] [uri "/app/.git/config"] [unique_id "aZFAjOaxHMLw2wrUo4P_CQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 03:13:44
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.47.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 22:13:36.934062 2026] [security2:error] [pid 11764:tid 11764] [client 104.207.47.130:11907] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sabbathseminars.net"] [uri "/frontend/.env"] [unique_id "aZE54A5ExYrK8KWVPhxIqAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack