🇩🇪
altenglaner
2026-10-09 08:58:26
UTC ·
(4 weeks ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 08:31:06
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 04:30:59.054178 2026] [security2:error] [pid 18472:tid 18472] [client 141.101.98.246:11542] ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 04:30:59.054178 2026] [security2:error] [pid 18472:tid 18472] [client 141.101.98.246:11542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.tjss.ac.cy"] [uri "/.env.dev"] [unique_id "asimQ6pCwkCgWD3J_QJSFQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-09 04:49:37
UTC ·
(4 weeks ago)
[09/Oct/2026:07:49:36 +0300] -- 141.101.98.246 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git-credentials HTTP/1.1
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-08 22:00:14
UTC ·
(4 weeks ago)
Auto-ban: >3000 req/min op 2026-10-08
Web App Attack
SSH
Hacking
🇫🇷
Bensay
2026-10-08 19:57:38
UTC ·
(4 weeks ago)
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=unknown
Port Scan
🇺🇸
TPI-Abuse
2026-10-08 17:21:51
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:21:46.708387 2026] [security2:error] [pid 5670:tid 5670] [client 141.101.98.246:11282] M ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:21:46.708387 2026] [security2:error] [pid 5670:tid 5670] [client 141.101.98.246:11282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danharrisphotoart.com"] [uri "/.env.production"] [unique_id "asfRKjmNat7yp0Eocd5zXwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 17:05:08
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:04:59.153798 2026] [security2:error] [pid 30432:tid 30432] [client 141.101.98.246:11187] ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:04:59.153798 2026] [security2:error] [pid 30432:tid 30432] [client 141.101.98.246:11187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enlightened-workplace.com"] [uri "/.env.production"] [unique_id "asfNO6WFafGFi3m_5T59egAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-08 16:31:28
UTC ·
(4 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
Bensay
2026-10-08 16:23:10
UTC ·
(4 weeks ago)
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safa ...
show more
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
show less
Port Scan
🇺🇸
TPI-Abuse
2026-10-08 15:26:21
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 11:26:12.687390 2026] [security2:error] [pid 32091:tid 32091] [client 141.101.98.246:13933] ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 11:26:12.687390 2026] [security2:error] [pid 32091:tid 32091] [client 141.101.98.246:13933] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.midway-island.com"] [uri "/.env.bak"] [unique_id "ase2FBphpkfAQ1ah0P8hPgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 14:05:28
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:05:20.157296 2026] [security2:error] [pid 26260:tid 26286] [client 141.101.98.246:13826] ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:05:20.157296 2026] [security2:error] [pid 26260:tid 26286] [client 141.101.98.246:13826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazinglips.com"] [uri "/.git/config"] [unique_id "asejIHOKXjy8oqilpEo64wAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 07:03:24
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 03:03:12.768274 2026] [security2:error] [pid 22425:tid 22425] [client 141.101.98.246:12387] ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 03:03:12.768274 2026] [security2:error] [pid 22425:tid 22425] [client 141.101.98.246:12387] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "halvaughan.com"] [uri "/.env.save"] [unique_id "asdAMDJmq8GcQ2Bq2qrujAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-08 05:15:51
UTC ·
(4 weeks ago)
3 attacks on password/key grabbing URLs:
GET /.aws/credentials HTTP/1.1
Hacking
🇺🇸
TPI-Abuse
2026-10-08 04:47:40
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 00:47:18.862967 2026] [security2:error] [pid 7219:tid 7219] [client 141.101.98.246:13595] M ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 00:47:18.862967 2026] [security2:error] [pid 7219:tid 7219] [client 141.101.98.246:13595] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toxicwater.com"] [uri "/.env.old"] [unique_id "ascgVt4ydWDT3khfqBVvZQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 03:12:07
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 23:12:02.231206 2026] [security2:error] [pid 24138:tid 24138] [client 141.101.98.246:10624] ...
show more
(mod_security) mod_security (id:210730) triggered by 141.101.98.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 23:12:02.231206 2026] [security2:error] [pid 24138:tid 24138] [client 141.101.98.246:10624] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ohwaitiforgot.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ohwaitiforgot.com"] [uri "/index.php.bak"] [unique_id "ascKApf7s2ME4liH54jE7wAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
