🇺🇸
TPI-Abuse
2026-10-12 08:12:19
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:12:11.331675 2026] [security2:error] [pid 24420:tid 24420] [client 135.136.20.30:26861] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blackballprojects.com"] [uri "/.env"] [unique_id "asyWWzIMFXKLBrI4dEtA8wAAAIE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Kejult
2026-10-12 08:00:11
(2 days ago)
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 3 application-level events across ...
show more
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 3 application-level events across 3 source port(s). Sensor(s): H0neytr4p.
show less
Port Scan
🇺🇸
TPI-Abuse
2026-10-12 05:51:26
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:51:22.044369 2026] [security2:error] [pid 12446:tid 12446] [client 135.136.20.30:24611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "parkplacemotel.com"] [uri "/.env"] [unique_id "asx1Wn077MP4uNSLY22-oQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 02:02:37
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 22:02:31.405698 2026] [security2:error] [pid 28641:tid 28641] [client 135.136.20.30:46383] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "deweysearch.com"] [uri "/.env"] [unique_id "asw_t7x2KoyUdi3c9vpYswAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
sfmet-admin
2026-10-12 01:37:12
(2 days ago)
135.136.20.30 - - [12/Oct/2026:01:37:11 +0000] "GET /.env HTTP/2.0" 200 55 "http://dev.sfmet.com/.en ...
show more
135.136.20.30 - - [12/Oct/2026:01:37:11 +0000] "GET /.env HTTP/2.0" 200 55 "http://dev.sfmet.com/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇨🇦
Sakusen
2026-10-12 01:33:12
(2 days ago)
Automated web attack: 98 reqs, 8 paths probed, 98 returned 404; probed: 6 other, 2 .env
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 01:25:45
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 135.136.20.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:25:43.046057 2026] [security2:error] [pid 27157:tid 27157] [client 135.136.20.30:48243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hazelzito.com"] [uri "/.env"] [unique_id "asw3F7oQM3N5xV-IOdvsbAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
tikket
2026-10-12 01:14:56
(2 days ago)
Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on ...
show more
Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on void.xn--q9jyb4c.
show less
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-10-12 01:01:17
(2 days ago)
Attack type: wordpress_attack_attempt | Target: /api/docker | UA: Go-http-client/2.0 | Country: GB
Web App Attack
Brute-Force
🇫🇷
Kejult
2026-10-12 01:00:36
(2 days ago)
Honeypot Finding: repeated TCP service probing on TCP/80 (HTTP); 4 application-level events across 4 ...
show more
Honeypot Finding: repeated TCP service probing on TCP/80 (HTTP); 4 application-level events across 4 source port(s). Sensor(s): Tanner.
show less
Port Scan
🇺🇸
1cyb3rpunk
2026-10-12 00:50:07
(2 days ago)
Coordinated campaign CMP-1791766207-209: 3 IPs sharing an attack fingerprint (debug_exposure). Obser ...
show more
Coordinated campaign CMP-1791766207-209: 3 IPs sharing an attack fingerprint (debug_exposure). Observed on sectrace.org honeypot surface.
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-10-12 00:10:53
(2 days ago)
doe-12 : Block return, carriage return, ... characters=>/?%3Cplay%3Ewithme%3C/%3E(>)
Hacking
2026-10-11 21:32:48
(2 days ago)
git/env leak probe
Web App Attack
🇫🇷
Kejult
2026-10-11 16:15:46
(2 days ago)
Honeypot Finding: verified TCP multi-port scan/probing; 33 application-level events across 2 target ...
show more
Honeypot Finding: verified TCP multi-port scan/probing; 33 application-level events across 2 target ports and 17 source port(s). Ports: 80/HTTP, 443/HTTPS. Sensors: Tanner, H0neytr4p.
show less
Port Scan
🇬🇧
oncord
2026-10-09 23:21:52
(4 days ago)
Form spam
Web Spam
