🇺🇸
TPI-Abuse
2026-11-10 11:53:26
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:53:22.404466 2026] [security2:error] [pid 5177:tid 5219] [client 109.107.230.52:24202] M ...
show more
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 06:53:22.404466 2026] [security2:error] [pid 5177:tid 5219] [client 109.107.230.52:24202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.seips.org"] [uri "/.env"] [unique_id "avMFstUQXRMBUQW0VTNIdwAAAkE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
clapper
2026-11-06 15:55:08
UTC ·
(4 days ago)
(mod_security) mod_security (id:949110) triggered by 109.107.230.52 (JO/Jordan/-): 5 in the last 600 secs; ID: rub
Brute-Force
Bad Web Bot
🇺🇸
Nodez3r0
2026-11-05 14:10:17
UTC ·
(5 days ago)
WOPR honeypot nedry.wopr.systems: 1 admin_probe (e.g. /.env); first seen 2026-11-05T14:10:17Z, last seen 2026-11-05T14:10:17Z
Web App Attack
Hacking
🇺🇸
Ben Schoolland
2026-11-05 10:22:51
UTC ·
(5 days ago)
Requested known WordPress backdoor/scanner-only paths (config backups, .env, .git/config). No legitimate use.
Bad Web Bot
Web App Attack
🇨🇦
AEITS
2026-11-05 09:18:08
UTC ·
(5 days ago)
Fail2Ban www
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 08:12:02
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:11:57.531090 2026] [security2:error] [pid 30683:tid 30683] [client 109.107.230.52:22726] ...
show more
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:11:57.531090 2026] [security2:error] [pid 30683:tid 30683] [client 109.107.230.52:22726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daretownkindling.com"] [uri "/.env"] [unique_id "auw6TZQCwnUKaz-Vz_zngwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 04:56:29
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:56:26.382454 2026] [security2:error] [pid 29030:tid 29030] [client 109.107.230.52:20397] ...
show more
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:56:26.382454 2026] [security2:error] [pid 29030:tid 29030] [client 109.107.230.52:20397] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "westonimports.com"] [uri "/.env"] [unique_id "auwMelWuiRdYgXGJt3nEKAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-11-05 01:34:15
UTC ·
(6 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.env (Match: /.env)
Hacking
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-04 19:09:05
UTC ·
(6 days ago)
[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 109.107.230.52 - - [04/Nov/2026:20:08:50 +0100] "GET /.env HTTP/2.0" 403 146 "-" "python-envmass/1.0"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 15:10:37
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:10:31.802691 2026] [security2:error] [pid 1790:tid 1790] [client 109.107.230.52:20867] M ...
show more
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:10:31.802691 2026] [security2:error] [pid 1790:tid 1790] [client 109.107.230.52:20867] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kemela.com"] [uri "/.env"] [unique_id "autK5_0ZZTWML7aYGCRtcwAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 14:44:46
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 09:44:39.435852 2026] [security2:error] [pid 16629:tid 16629] [client 109.107.230.52:18483] ...
show more
(mod_security) mod_security (id:210492) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 09:44:39.435852 2026] [security2:error] [pid 16629:tid 16629] [client 109.107.230.52:18483] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "velvetculture.com"] [uri "/.env"] [unique_id "autE14GsSEBqLl5OtfgLxAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rip
2026-11-04 09:43:32
UTC ·
(6 days ago)
Restricted File Access Attempts
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 01:46:14
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 21:46:08.894423 2026] [security2:error] [pid 25208:tid 25212] [client 109.107.230.52:39224] ...
show more
(mod_security) mod_security (id:210730) triggered by 109.107.230.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 21:46:08.894423 2026] [security2:error] [pid 25208:tid 25212] [client 109.107.230.52:39224] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||charteredwealthmanager.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "charteredwealthmanager.com"] [uri "/http/charteredfinancialmanager.com"] [unique_id "auVIYPXpMnrHZPY-zS3bSwAAAIE"], referer: https://charteredwealthmanager.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
MatStef132
2026-10-27 06:51:44
UTC ·
(2 weeks ago)
MatShield L7: blocked on unlocknow.cc (sec-fetch-before-safari-16)
DDoS Attack
🇨🇭
ALPHANET
2026-10-03 01:40:21
UTC ·
(1 month ago)
Botnet or web spider not respecting robots.txt
DDoS Attack
Exploited Host
