🇬🇧
thetomtaylor.co.uk
2026-06-12 14:06:02
(1 week ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice01]
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-06-12 13:08:01
(1 week ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice02,mx01,mx02,mx03,wa ...
show more
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice02,mx01,mx02,mx03,wa01]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 12:38:13
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 08:38:06.095851 2026] [security2:error] [pid 7696:tid 7719] [client 104.234.208.143:61643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "accuball.com"] [uri "/.env"] [unique_id "aiv9rgDt7kkvR2zL4hrfswAAARU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Bedios GmbH
2026-06-12 11:56:39
(2 weeks ago)
Login credentials theft attempt
Hacking
🇺🇸
TPI-Abuse
2026-06-12 11:17:50
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 07:17:43.322152 2026] [security2:error] [pid 4691:tid 4691] [client 104.234.208.143:54817] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aeservices.com"] [uri "/.env"] [unique_id "aivq1_Oeuko_si6EI_63tAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 10:22:59
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 06:22:54.329299 2026] [security2:error] [pid 23228:tid 23228] [client 104.234.208.143:25073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bizecomm.net"] [uri "/.env"] [unique_id "aivd_ll8IVpd4mGV7ML82wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-06-12 10:07:01
(2 weeks ago)
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [wa02]
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
DZBOT
2026-06-12 03:21:18
(2 weeks ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇩🇪
big-cloud.nl
2026-06-11 19:54:21
(2 weeks ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 19:17:37
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 15:17:30.717264 2026] [security2:error] [pid 29801:tid 29801] [client 104.234.208.143:51437] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cincypcs.net"] [uri "/.env"] [unique_id "aisJygY6P-GWU8g-hHCofwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 17:28:08
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 13:28:03.094872 2026] [security2:error] [pid 1230:tid 1230] [client 104.234.208.143:64557] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bonnesfrequences.com"] [uri "/.env"] [unique_id "airwI3QP5HAAPLGW2QSGkQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-11 17:06:02
(2 weeks ago)
104.234.208.143 - - [12/Jun/2026:01:06:01 +0800] "GET /.env HTTP/1.1" 404 300905 "-" "Mozilla/5.0 (M ...
show more
104.234.208.143 - - [12/Jun/2026:01:06:01 +0800] "GET /.env HTTP/1.1" 404 300905 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 15:24:24
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 11:24:20.275347 2026] [security2:error] [pid 18355:tid 18369] [client 104.234.208.143:21471] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coldwave.net"] [uri "/.env"] [unique_id "airTJOhbuQZF6kDYmhtHMgAAAUo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 14:31:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.234.208.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 10:31:25.677350 2026] [security2:error] [pid 27142:tid 27167] [client 104.234.208.143:65021] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "12am.us"] [uri "/.env"] [unique_id "airGve1o9xD5k-pUbbLYRgAAARY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-06-11 13:51:07
(2 weeks ago)
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. O ...
show more
ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack