🇧🇪
madeit
2026-09-28 17:41:33
(3 days ago)
Web App Attack
🇵🇱
MatStef132
2026-08-29 22:32:31
(1 month ago)
MatShield L7: blocked on api.klovy.chat (ua-quarantined)
Bad Web Bot
🇧🇪
madeit
2026-08-22 08:01:06
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-14 13:12:29
(1 month ago)
Web App Attack
🇩🇪
IVski.com
2026-07-16 11:04:41
(2 months ago)
IVski WAF | Sensitive file probe detected - looking for .env
Port Scan
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-06-25 12:01:59
(3 months ago)
Multiple WAF Violations
Web App Attack
2026-04-12 20:20:02
(5 months ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 03:20:06
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:20:02.760203 2026] [security2:error] [pid 13337:tid 13337] [client 104.23.253.136:9816] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.whaletailpuckerbutt.com"] [uri "/.env.old"] [unique_id "adCDYtZeygz0mnja-jIwlAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 15:27:40
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 11:27:35.045131 2026] [security2:error] [pid 21717:tid 21717] [client 104.23.253.136:12549] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.carmel.xyz"] [uri "/.env_config"] [unique_id "ac6K5w9FMIO6WHrkhKPgsQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 05:08:29
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 01:08:24.373267 2026] [security2:error] [pid 13730:tid 13735] [client 104.23.253.136:12500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lead-sleds.com"] [uri "/.env_secret"] [unique_id "ab4nyNUB98ALs8vSgpQtJgAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-03-20 13:08:45
(6 months ago)
Scanning/Probing (16)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 08:32:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:32:34.975920 2026] [security2:error] [pid 23027:tid 23027] [client 104.23.253.136:10620] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stern2.darkhorseyachting.com"] [uri "/admin/.env"] [unique_id "ab0GItUFcEx5Ly5nKdH00QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:36:30
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:36:13.555682 2026] [security2:error] [pid 23510:tid 23510] [client 104.23.253.136:13103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aangfl.com"] [uri "/.env1"] [unique_id "abzq3dl-fWzshiDsAu3xiAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:48:52
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:48:46.639000 2026] [security2:error] [pid 3520:tid 3520] [client 104.23.253.136:14032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.the-schlosser.net"] [uri "/admin/.env"] [unique_id "abzfviMSdtjbhiIrVZL75wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:25:33
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:25:28.573604 2026] [security2:error] [pid 2460131:tid 2460131] [client 104.23.253.136:12840] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.coffeewitheinstein.com"] [uri "/.env.json"] [unique_id "abzaSDwbZia9gVxJKuDleQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
