🇳🇱
homeshowdomain.nl
2026-06-08 21:59:34
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-07.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-06-07 14:55:09
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 10:55:06.708377 2026] [security2:error] [pid 28729:tid 28737] [client 145.79.212.180:25206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windstream-sales.com"] [uri "/core/.env.save"] [unique_id "aiWGSm-sELZmMpTkVbtxfwAAAUY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
simsung
2026-06-07 14:41:31
(1 week ago)
145.79.212.180 - - [07/Jun/2026:14:41:29 +0000] "GET /dev/.env HTTP/1.1" 403 548 "-" "Mozilla/5.0 (M ...
show more
145.79.212.180 - - [07/Jun/2026:14:41:29 +0000] "GET /dev/.env HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-07 13:15:32
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 09:15:28.879153 2026] [security2:error] [pid 23396:tid 23396] [client 145.79.212.180:44722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "moontouchmassage.com"] [uri "/core/.env"] [unique_id "aiVu8Pd-gjoN1yBw1ytjXwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 12:45:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 08:45:12.925297 2026] [security2:error] [pid 9569:tid 9569] [client 145.79.212.180:56276] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chatsupply.us"] [uri "/api/.env.save"] [unique_id "aiVn2ISSwO7PnKk0qcLnpwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 12:21:21
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 08:21:14.212141 2026] [security2:error] [pid 29606:tid 29606] [client 145.79.212.180:46986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "puckerbuttbikini.com"] [uri "/members/.env"] [unique_id "aiViOhVPL1f5ozJfiKyLlwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-06-07 12:08:01
(1 week ago)
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice02,wa01,wa02]
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 10:43:20
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 06:43:15.989764 2026] [security2:error] [pid 559:tid 559] [client 145.79.212.180:34876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thorndikestudio.com"] [uri "/api/.env"] [unique_id "aiVLQ_XpjdFg071cCsNyrgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
szasa
2026-06-07 10:34:52
(1 week ago)
2026/06/07 12:34:52 [error] 1832268#1832268: *3320188 access forbidden by rule, client: 145.79.212.1 ...
show more
2026/06/07 12:34:52 [error] 1832268#1832268: *3320188 access forbidden by rule, client: 145.79.212.180, server: datamentor.hu, request: "GET /.env HTTP/1.1", host: "beszerzokozpont.hu"
2026/06/07 12:34:52 [error] 1832268#1832268: *3320192 access forbidden by rule, client: 145.79.212.180, server: datamentor.hu, request: "GET /dev/.env HTTP/1.1", host: "beszerzokozpont.hu"
2026/06/07 12:34:52 [error] 1832268#1832268: *3320191 access forbidden by rule, client: 145.79.212.180, server: datamentor.hu, request: "GET /members/.env HTTP/1.1", host: "beszerzokozpont.hu"
2026/06/07 12:34:52 [error] 1832268#1832268: *3320193 access forbidden by rule, client: 145.79.212.180, server: datamentor.hu, request: "GET /core/.env HTTP/1.1", host: "beszerzokozpont.hu"
...
show less
Web App Attack
2026-06-07 10:21:03
(1 week ago)
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /app/.env HTTP/1.1, GET /member ...
show more
Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /app/.env HTTP/1.1, GET /members/.env HTTP/1.1, GET /laravel/.env HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
nyt
2026-06-07 10:10:10
(1 week ago)
Sensitive File Probe
Web App Attack
2026-06-07 10:10:02
(1 week ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 07:46:27
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 145.79.212.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 03:46:24.334727 2026] [security2:error] [pid 29676:tid 29676] [client 145.79.212.180:40494] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "roadtosalvation.org"] [uri "/app/.env"] [unique_id "aiUh0NMNmXhkh3Pw2yc9AQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Terrier
2026-06-07 07:04:02
(1 week ago)
Blocked for HTTP vulnerability scanning (excessive 404)
Web App Attack
🇺🇸
Matthew Ping
2026-06-07 06:45:03
(1 week ago)
ModSecurity rule 949110 triggered on dedicated. Web application attack blocked by CSF/LFD.
Web App Attack
Hacking