2026-07-17 17:12:03
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env.local HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 13:00:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 09:00:52.391665 2026] [security2:error] [pid 1098495:tid 1098495] [client 121.11.102.118:49364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "televisonic.com"] [uri "/.env.production"] [unique_id "alonhO6xRxRdv3jMGBlKcQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 11:16:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 07:16:48.124597 2026] [security2:error] [pid 713723:tid 713723] [client 121.11.102.118:45313] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "towardthesky.com"] [uri "/.env"] [unique_id "aloPIKN-tnJxkTGP4pd3uQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 10:29:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 06:29:20.665088 2026] [security2:error] [pid 10812:tid 10812] [client 121.11.102.118:55648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danzantesdehuesca.com"] [uri "/.env"] [unique_id "aloEAPGbkPjnwOi8b88QlQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:40:37
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:40:30.083051 2026] [security2:error] [pid 26678:tid 26678] [client 121.11.102.118:38850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bank.gisur.com"] [uri "/.env~"] [unique_id "alnqfm2Zkc-TSK8ea4ikjwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 07:52:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 03:52:45.312863 2026] [security2:error] [pid 624798:tid 624798] [client 121.11.102.118:44498] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jetpower.com"] [uri "/.env"] [unique_id "alnfTRJUJiF1gdryMFKlWgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
djboddington
2026-07-17 07:04:49
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-07-17 05:06:45
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:06:38.378261 2026] [security2:error] [pid 14749:tid 14749] [client 121.11.102.118:37412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jeremy-olson.com.mngop47.org"] [uri "/.env.test.local"] [unique_id "alm4XmX8qMA2qkYMRHFRhwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-07-17 04:55:54
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 03:32:40
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:32:34.371425 2026] [security2:error] [pid 23073:tid 23073] [client 121.11.102.118:43347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.forums.underraided.com"] [uri "/.env.backup"] [unique_id "almiUmiXiwy7wKdFJBz7iAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 03:09:31
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:09:24.461017 2026] [security2:error] [pid 15546:tid 15546] [client 121.11.102.118:55424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mitchell238.macryder.com"] [uri "/client/.env"] [unique_id "almc5P_b4QMNjJ7kKm7yFQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 02:41:13
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 22:41:04.950648 2026] [security2:error] [pid 584:tid 584] [client 121.11.102.118:36727] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "insidepublications.com"] [uri "/private/.env"] [unique_id "almWQEYQH6T-N73_sY62KQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 00:16:45
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 20:16:37.987100 2026] [security2:error] [pid 9665:tid 9665] [client 121.11.102.118:53257] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alrevora.com"] [uri "/.env.backup"] [unique_id "all0ZRE0hDSmz-qDS5yJ3AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ba-Yu
2026-07-16 22:50:45
(2 days ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 21:52:54
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 121.11.102.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 17:52:50.020650 2026] [security2:error] [pid 534162:tid 534162] [client 121.11.102.118:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.dentguyvt.com"] [uri "/.env.test"] [unique_id "allSsqeVKugB9zkOljCZXwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack