🇺🇸
TPI-Abuse
2026-06-27 00:49:00
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 20:48:55.099454 2026] [security2:error] [pid 5312:tid 5312] [client 104.28.251.199:53743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.snapdragonworkshops.com"] [uri "/.env.local.old"] [unique_id "aj8d990D-wno4-gPL33tJAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇪
AutosOnShow
2026-06-26 21:04:06
(12 hours ago)
blocked for webapp attack | path requested: /.git/config | seen at 2026-06-26 21:03:38.543 |
Web App Attack
2026-06-26 20:49:36
(12 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 18:41:36
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 14:41:32.810777 2026] [security2:error] [pid 12789:tid 12789] [client 104.28.251.199:19443] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.leothecolorman.com"] [uri "/.env.production.copy"] [unique_id "aj7H3LDCB3BQPtLRCv9iCQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-26 18:31:57
(14 hours ago)
117 requests with url.path *.env
Brute-Force
Bad Web Bot
🇬🇧
djboddington
2026-06-26 18:20:44
(15 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-06-26 17:27:47
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 13:27:42.886676 2026] [security2:error] [pid 963:tid 984] [client 104.28.251.199:9318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.barnett-ranch.com"] [uri "/.env.production.copy"] [unique_id "aj62jm0Xw9GxYm94LS8EcQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-06-26 13:26:01
(20 hours ago)
Attack against Apache (too many 404s)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 13:23:41
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 09:23:35.794123 2026] [security2:error] [pid 26772:tid 26772] [client 104.28.251.199:19561] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.joukoji.com"] [uri "/dist/.htpasswd"] [unique_id "aj59V4_71d6AtNRsYlJejAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 12:54:26
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 08:54:20.428774 2026] [security2:error] [pid 24455:tid 24455] [client 104.28.251.199:28985] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.pixelspective.com"] [uri "/.git/FETCH_HEAD"] [unique_id "aj52fKxJWNgFVEtfQF1V_wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-26 12:02:56
(21 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-06-26 11:11:07
(22 hours ago)
Aggressive web search of vulnerable pages: /dist/config.yml /dist/wp-config.php /dist/configuration. ...
show more
Aggressive web search of vulnerable pages: /dist/config.yml /dist/wp-config.php /dist/configuration.php /build/.env /build/config.yml /build/co ...
show less
Web App Attack
2026-06-26 08:58:05
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /.env.local.copy HTTP/1.1, GET ...
show more
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /.env.local.copy HTTP/1.1, GET /.git/logs/HEAD HTTP/1.1, GET /.env.old HTTP/1.1, GET /.git/FETCH_HEAD HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.copy HTTP/1.1, GET /.env.local.bak HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.git/refs/heads/master HTTP/1.1, GET /.env.production.copy HTTP/1.1, GET /.env.orig HTTP/1.1, GET /.env.local.old HTTP/1.1, GET /.git/HEAD HTTP/1.1, GET /.git/config HTTP/1.1, GET /.git/refs/heads/main HTTP/1.1, GET / HTTP/1.1, GET /.env.production.save HTTP/1.1, GET /.env~ HTTP/1.1, GET /.env.local.save HTTP/1.1, GET /.env.production~ HTTP/1.1, GET /.env.local.backup HTTP/1.1, GET /public/.aws/credentials HTTP/1.1, GET /web/.env HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 04:13:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 00:13:05.660769 2026] [security2:error] [pid 11735:tid 11735] [client 104.28.251.199:44317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dinkusdrums.com"] [uri "/api/.htpasswd"] [unique_id "aj38Ucjj33F1UGYV2uN_tgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 03:50:23
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.251.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 23:50:18.580325 2026] [security2:error] [pid 3875:tid 3875] [client 104.28.251.199:41216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.utah17.com"] [uri "/.git/config"] [unique_id "aj32-ucY70oR_TnHFIKg3QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack