🇳🇱
homeshowdomain.nl
2026-09-30 21:59:04
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-29.
show less
Web App Attack
SSH
Hacking
🇳🇱
homeshowdomain.nl
2026-09-29 21:59:10
(1 week ago)
Auto-ban: >3000 req/min op 2026-09-29
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-09-29 15:40:48
(1 week ago)
csagent: score 19.9: 404 noise floor x4, secrets grab x2; 2 domain(s) in 18s
Web App Attack
🇺🇸
dtorrer
2026-09-29 15:32:18
(1 week ago)
General vulnerability scan.
Port Scan
🇺🇸
TPI-Abuse
2026-09-29 15:19:14
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 11:19:10.347198 2026] [security2:error] [pid 17685:tid 17685] [client 105.112.199.196:43850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathydumesnilart.com"] [uri "/.env"] [unique_id "arvW7gjUEpQ5gezF8iLIVQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 13:49:14
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 09:49:06.863015 2026] [security2:error] [pid 8710:tid 8710] [client 105.112.199.196:12103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joy.joebankx.com"] [uri "/.env"] [unique_id "arvB0uwFRzlYhGzB6T6HUgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-29 12:13:56
(1 week ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 11:51:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 07:51:07.871277 2026] [security2:error] [pid 12864:tid 12864] [client 105.112.199.196:28231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "k2medianetworks.com"] [uri "/.env"] [unique_id "arumKwQMuNKpMMfobrJHGQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-29 07:59:13
(1 week ago)
Scanner hitting /.env on livekit.picsou.cloud (ORG-VNL1-AFRINIC) — aaguard
Brute-Force
Port Scan
🇩🇪
neckaralb-admin.de
2026-09-29 05:30:30
(1 week ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 04:53:54
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 00:53:49.710566 2026] [security2:error] [pid 17258:tid 17258] [client 105.112.199.196:45361] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "livebord.com"] [uri "/.env"] [unique_id "artEXfisa9YuAtF29dwHzwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 04:04:18
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 00:04:11.801240 2026] [security2:error] [pid 4611:tid 4626] [client 105.112.199.196:32692] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "josephablumphotography.com"] [uri "/.env"] [unique_id "ars4u9-xYQtcVfb7C8EDfAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-09-29 01:36:00
(1 week ago)
block ruleset bad bot: misc bad content F608233CC4C86EE814CE8DDDA9C4A0D3C79882F6
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-29 01:18:26
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 21:18:19.324308 2026] [security2:error] [pid 26592:tid 26592] [client 105.112.199.196:22763] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "limbertree.com"] [uri "/.env"] [unique_id "arsR22PyQi5TDalmBUx7agAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 00:47:32
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 105.112.199.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 20:47:29.041899 2026] [security2:error] [pid 6241:tid 6241] [client 105.112.199.196:6922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlehorndesign.com"] [uri "/.env"] [unique_id "arsKoRf3lcTiP-8zOuvZFgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
