🇺🇸
TPI-Abuse
2026-10-07 06:38:39
(45 minutes ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 02:38:31.739764 2026] [security2:error] [pid 30400:tid 30400] [client 141.101.99.96:11412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "evolutionmedical.help"] [uri "/.env.staging"] [unique_id "asXo5wGS_Zp7d0g-uCI1SQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-07 05:33:19
(1 hour ago)
[07/Oct/2026:08:33:19 +0300] -- 141.101.99.96 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[07/Oct/2026:08:33:19 +0300] -- 141.101.99.96 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /appsettings.json HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-07 03:10:41
(4 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 00:26:48
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 20:26:43.751203 2026] [security2:error] [pid 28746:tid 28746] [client 141.101.99.96:11469] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staging.lindenwoodpark.org"] [uri "/.env"] [unique_id "asWRwzpXQnEIA9CqQi-h5gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 23:10:31
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 19:10:25.209197 2026] [security2:error] [pid 4751:tid 4760] [client 141.101.99.96:11973] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lasertagmetairie.com"] [uri "/.env.old"] [unique_id "asV_4QwkDBcYvGA9WJrkJgAAAQc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 12:28:12
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 08:28:03.581212 2026] [security2:error] [pid 30097:tid 30097] [client 141.101.99.96:12545] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hendersonhomes.com"] [uri "/.env.local"] [unique_id "asTpU5ZsYHP1EmTp0h8QvQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-10-06 11:31:47
(19 hours ago)
[TueOct0613:31:44.3304952026][security2:error][pid2283022:tid2283046][client141.101.99.96:0]ModSecur ...
show more
[TueOct0613:31:44.3304952026][security2:error][pid2283022:tid2283046][client141.101.99.96:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"hostingsvizzera.ch\"][uri\"/.env.bak\"][unique_id\"asTcIBvCowJjTE05LY9zSgAAARY\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 10:39:20
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 06:39:14.538519 2026] [security2:error] [pid 19978:tid 19978] [client 141.101.99.96:11705] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "desertalfas.org"] [uri "/.htaccess"] [unique_id "asTP0rDcVbXGMdPSP_mD9QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 09:30:13
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 05:29:56.907009 2026] [security2:error] [pid 7084:tid 7084] [client 141.101.99.96:14144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drayvian.com"] [uri "/.env.bak"] [unique_id "asS_lI3I4MCxyZhieykcWwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 05:58:17
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 01:58:12.125211 2026] [security2:error] [pid 1344543:tid 1344574] [client 141.101.99.96:11193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "isoceansl.com"] [uri "/wp-config.php.old"] [unique_id "asSN9Ea5PCLz01s2DjnoSwAAAVE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 03:20:37
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 23:20:24.814718 2026] [security2:error] [pid 14053:tid 14053] [client 141.101.99.96:9721] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daassociatesllc.com"] [uri "/wp-config.php.save"] [unique_id "asRo-BSZ6hlefp6NTa-AlwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-06 03:11:15
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 02:02:34
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 22:02:23.603642 2026] [security2:error] [pid 12562:tid 12562] [client 141.101.99.96:11735] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "handankoc.net"] [uri "/.env.old"] [unique_id "asRWr69zXPijtuOn33_C_gAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 23:52:20
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 19:52:15.000757 2026] [security2:error] [pid 7528:tid 7528] [client 141.101.99.96:9259] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tribalpacifica.com"] [uri "/.env.old"] [unique_id "asQ4LxblYQnFOH2mh3VkPAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 22:55:17
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 141.101.99.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 18:54:42.605920 2026] [security2:error] [pid 7156:tid 7156] [client 141.101.99.96:12212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rangerroma.com"] [uri "/.env.dev"] [unique_id "asQqskDeonMWBM54rBApEgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
