🇧🇪
madeit
2026-10-12 19:23:35
(19 hours ago)
Web App Attack
🇵🇰
sbk97 (https://sayor.net)
2026-10-04 07:40:38
(1 week ago)
SAYOR honeypot: observed attack /blog/bl-kernel/css/bootstrap.min.css?version=3.16.2
Brute-Force
🇺🇸
TPI-Abuse
2026-10-01 07:00:33
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 03:00:28.892728 2026] [security2:error] [pid 30687:tid 30687] [client 104.23.187.22:10728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alexgitlin.com"] [uri "/.htaccess"] [unique_id "ar4FDL9WtIcERWHPg2aUnAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
MatStef132
2026-08-29 22:32:32
(1 month ago)
MatShield L7: blocked on api.klovy.chat (ua-quarantined)
Bad Web Bot
🇬🇧
CrystalMaker
2026-07-02 01:31:43
(3 months ago)
Vulnerability scan - GET /nuxt.config.ts HTTP/2.0
Hacking
🇺🇸
TPI-Abuse
2026-03-30 08:22:22
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 04:22:16.545384 2026] [security2:error] [pid 21688:tid 21688] [client 104.23.187.22:10452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.mrbss.com"] [uri "/.env_backup"] [unique_id "acoyuFDd9_aZ-Mkk4sR6MAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 04:32:03
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 00:31:53.893562 2026] [security2:error] [pid 28311:tid 28311] [client 104.23.187.22:12492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.luxebikinis.com"] [uri "/site/.env"] [unique_id "acn8ucaX0PiHwIcUsLHxJAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 19:00:26
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 15:00:20.348908 2026] [security2:error] [pid 9854:tid 9854] [client 104.23.187.22:11152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.networklivemusic.com"] [uri "/.env.backup"] [unique_id "ab7qxFMkfTuvPWFQgezY4gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 01:30:20
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 21:30:14.699916 2026] [security2:error] [pid 26918:tid 26918] [client 104.23.187.22:11807] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ez1productions.thinksite.net"] [uri "/docker/.env.local"] [unique_id "ab30pvrjwQbL2jUXnxCBKQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 09:00:28
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:00:21.767661 2026] [security2:error] [pid 24630:tid 24630] [client 104.23.187.22:11058] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.bostonlog.com"] [uri "/.env.dev.local"] [unique_id "ab0MpZ3f9DvRPC2gkhNNPwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:19:49
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:19:44.963572 2026] [security2:error] [pid 27929:tid 27929] [client 104.23.187.22:12343] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.wfowisdom.com"] [uri "/.env.prod"] [unique_id "abzY8Dx46cpgVv7aDYtfpwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:10:32
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:10:26.828900 2026] [security2:error] [pid 32536:tid 32536] [client 104.23.187.22:13775] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.title44.com.itaxcenter.com"] [uri "/.env.docker"] [unique_id "abzIsmu2QTUHWR3jz1EZpQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:18:26
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:18:10.100738 2026] [security2:error] [pid 10231:tid 10231] [client 104.23.187.22:9560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.efhgtc.org"] [uri "/config/.env.local"] [unique_id "aby8ciSo5s81OZzrlVPGpQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:48:17
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:48:11.886794 2026] [security2:error] [pid 11892:tid 11892] [client 104.23.187.22:12985] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.glicksmandro.com.truefauxstudio.com"] [uri "/home/.env"] [unique_id "aby1azY6MuACzSPQdGljmgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:19:28
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:19:20.738350 2026] [security2:error] [pid 18202:tid 18202] [client 104.23.187.22:12890] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.edgecombe.net"] [uri "/docker/.env.local"] [unique_id "abyuqMZ9_ae0pZa8AExC6QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
