🇩🇪
neckaralb-admin.de
2026-10-06 20:42:08
(48 minutes ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 20:25:40
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 16:25:31.137509 2026] [security2:error] [pid 7627:tid 7627] [client 141.101.99.9:14054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jsommer.com"] [uri "/.env"] [unique_id "asVZOz-anwqTGzp7Fm-xSQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 16:19:31
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 12:19:22.529353 2026] [security2:error] [pid 18894:tid 18894] [client 141.101.99.9:10655] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chezlubacov.org"] [uri "/.git/HEAD"] [unique_id "asUfigkSWRa87Pi6un5KrQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 15:41:37
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 11:41:31.911501 2026] [security2:error] [pid 16864:tid 16864] [client 141.101.99.9:12052] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ptr.dutchlake.com"] [uri "/.env.save"] [unique_id "asUWq9xbyakXERpAe1uw5AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-06 14:39:10
(6 hours ago)
[06/Oct/2026:17:39:10 +0300] -- 141.101.99.9 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /w ...
show more
[06/Oct/2026:17:39:10 +0300] -- 141.101.99.9 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /wp-config.php.bak HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 14:12:42
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 10:12:35.193728 2026] [security2:error] [pid 25283:tid 25283] [client 141.101.99.9:12444] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "herstonfarm.com"] [uri "/.env.dev"] [unique_id "asUB08NJ0PMCfGh14XsxdwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 11:44:21
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 07:44:10.076077 2026] [security2:error] [pid 9910:tid 10039] [client 141.101.99.9:11123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cityofmiddleton.org"] [uri "/.env"] [unique_id "asTfCk9XbPiREMMEgJ1BLAAAANQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
barbarella
2026-10-06 10:58:43
(10 hours ago)
Multiple (2) times attack on https port 443: Configuration snooping in .env file (GET /.env.dev)
...
show more
Multiple (2) times attack on https port 443: Configuration snooping in .env file (GET /.env.dev)
12:58:43 Configuration snooping in .env file (GET /.env.backup)
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 10:01:00
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 06:00:46.845985 2026] [security2:error] [pid 8180:tid 8180] [client 141.101.99.9:9593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "majesticsolutions.co"] [uri "/.env.old"] [unique_id "asTGzu2WQv-swO6fI3QNEgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-06 06:51:57
(14 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 04:39:09
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 00:38:58.671317 2026] [security2:error] [pid 4718:tid 4718] [client 141.101.99.9:12493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "title30.com"] [uri "/.env.local"] [unique_id "asR7Yk9gLtCqrQohMqlUngAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 04:21:17
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 00:21:08.860613 2026] [security2:error] [pid 19186:tid 19186] [client 141.101.99.9:9952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.guitarwisdom.com"] [uri "/.env.dev"] [unique_id "asR3NAAJaHLzfQrDWyQGAwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 23:45:02
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 19:44:57.927938 2026] [security2:error] [pid 29227:tid 29238] [client 141.101.99.9:10252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogamur.com"] [uri "/.env.save"] [unique_id "asQ2eectxxOWhPQJzYxSLQAAAEk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 21:37:17
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 17:37:07.743150 2026] [security2:error] [pid 5176:tid 5176] [client 141.101.99.9:10082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "new-bethel-baptist-church.com"] [uri "/.env.bak"] [unique_id "asQYgwZ99cUuPsN6jPticQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 21:11:28
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 17:11:18.616115 2026] [security2:error] [pid 10700:tid 10700] [client 141.101.99.9:10472] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "owengmail.com"] [uri "/.env.staging"] [unique_id "asQSdmAeACpH9REShyl5JAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
