2026-02-24 15:56:38
(3 months ago)
Web App Attack
🇺🇸
oncord
2026-02-19 16:44:15
(3 months ago)
Form spam
Web Spam
🇦🇺
oncord
2026-02-15 19:33:04
(3 months ago)
Form spam
Web Spam
🇬🇧
Smish
2026-02-12 07:37:50
(4 months ago)
HONEYPOT HIT --> Fail2ban time=1770881868 log=2026-02-12T07:37:48+00:00 ip=104.207.51.33 host=as2106 ...
show more
HONEYPOT HIT --> Fail2ban time=1770881868 log=2026-02-12T07:37:48+00:00 ip=104.207.51.33 host=as210667.net method=GET uri="/.env.save" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ref="-" rid=b1988c09ca4f1e3bb5b95fb8ad363aa4
show less
Web App Attack
🇧🇾
lns.bz
2026-02-10 21:05:56
(4 months ago)
.env scanning [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 04:37:02
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:36:55.053533 2026] [security2:error] [pid 13813:tid 13813] [client 104.207.51.33:54189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kletzer.com"] [uri "/admin/.git/config"] [unique_id "aYq155A0XKHVSEDmZjN4fwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-10 04:31:25
(4 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
TPI-Abuse
2026-02-10 02:20:14
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:20:09.051971 2026] [security2:error] [pid 26927:tid 26927] [client 104.207.51.33:41223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kim-porter.com"] [uri "/admin/.env"] [unique_id "aYqV2X2bouFIvT6_tTNu0wAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 01:54:23
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 20:54:15.454748 2026] [security2:error] [pid 26294:tid 26294] [client 104.207.51.33:44477] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madandproud.com"] [uri "/frontend/.env"] [unique_id "aYqPx1u-U_0c02VCM_Bv4wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Carsten
2026-02-10 01:34:21
(4 months ago)
GET [.env.local]
Port Scan
🇺🇸
TPI-Abuse
2026-02-09 21:39:59
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 16:39:50.837959 2026] [security2:error] [pid 14039:tid 14039] [client 104.207.51.33:26833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garrettkirkland.com"] [uri "/v2/.git/config"] [unique_id "aYpUJtqXn7uqOEHEelnN0QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2026-02-09 21:08:03
(4 months ago)
Blocking for trying to access an exploit file: /app/.env
Hacking
🇺🇸
TPI-Abuse
2026-02-09 20:46:27
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 15:46:19.710668 2026] [security2:error] [pid 1626:tid 1626] [client 104.207.51.33:9025] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honorherwish.org"] [uri "/app/.env"] [unique_id "aYpHm7-aW_pAQyaPEqq9WgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 19:45:52
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 14:45:48.365799 2026] [security2:error] [pid 32306:tid 32306] [client 104.207.51.33:37377] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gaeltv.com"] [uri "/.env.save"] [unique_id "aYo5bKrknS6Riew2uwLrWgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 12:48:22
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.51.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 07:48:15.474560 2026] [security2:error] [pid 19643:tid 19643] [client 104.207.51.33:18127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fundingangelinvestors.com"] [uri "/dev/.git/config"] [unique_id "aYnXj3XHliMqxbNI9mtQfQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack