🇩🇪
altenglaner
2026-10-15 23:53:57
(13 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇩🇪
iNetWorker
2026-10-15 22:28:13
(14 hours ago)
trolling for resource vulnerabilities
Web App Attack
🇨🇦
polycoda
2026-10-15 18:28:32
(18 hours ago)
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based ...
show more
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based) - ❌ Excessive 40X Errors (Decay-Based)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 17:56:05
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 13:55:59.960259 2026] [security2:error] [pid 28109:tid 28129] [client 104.22.23.28:13568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "accutar.com"] [uri "/.env.backup"] [unique_id "atETr1g9EWl2OduhgS_f2AAAAI8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-15 17:25:01
(20 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 16:29:42
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 12:29:31.443987 2026] [security2:error] [pid 24838:tid 24838] [client 104.22.23.28:12663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stalbansparish.org"] [uri "/.env.bak"] [unique_id "atD_ax1wKQLVn-fQAc6BwAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 14:14:55
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:14:48.295277 2026] [security2:error] [pid 22669:tid 22669] [client 104.22.23.28:11597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bwill.dev"] [uri "/.env"] [unique_id "atDf2KgIrx_BplaN6olQ6wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:48:20
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:48:00.771966 2026] [security2:error] [pid 10522:tid 10642] [client 104.22.23.28:10673] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.biblewriter.com"] [uri "/.env.backup"] [unique_id "atDZkFn_qD0aBbcc9pmeHQAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-15 12:19:56
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:57:57
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:57:42.483592 2026] [security2:error] [pid 25239:tid 25239] [client 104.22.23.28:10934] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||franknash.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "franknash.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "atCxpsQOrfqCJFLW__8NCgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 09:51:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 05:51:31.142452 2026] [security2:error] [pid 12340:tid 12340] [client 104.22.23.28:10072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cruisevacationtickets.com"] [uri "/.git/HEAD"] [unique_id "atCiI4XwdZSsc-g_O44KHQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 08:57:18
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 04:57:02.414482 2026] [security2:error] [pid 8126:tid 8126] [client 104.22.23.28:9794] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||allisonstiles.org|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "allisonstiles.org"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "atCVXrqwrEfI9qE4VeKuMQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 07:45:21
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 03:44:55.350678 2026] [security2:error] [pid 13353:tid 13353] [client 104.22.23.28:13610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hazardrecords.org"] [uri "/.env.save"] [unique_id "atCEdz-YDU_EqGWcStxxqgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-08 07:13:23
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-17 23:14:16
(1 month ago)
Web App Attack
