🇺🇸
TPI-Abuse
2026-05-23 23:37:03
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 19:36:56.112166 2026] [security2:error] [pid 30323:tid 30323] [client 149.143.135.210:4042 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 19:36:56.112166 2026] [security2:error] [pid 30323:tid 30323] [client 149.143.135.210:40425] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cnwire.com"] [uri "/.env.release"] [unique_id "ahI6GKIoSzErKZBBN8skIQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
theanalogmaker
2026-05-20 00:15:10
UTC ·
(5 months ago)
CrowdSec: AbuseIPDB 77% (US, 50 reports) (720h ban)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 12:33:47
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 08:33:38.890227 2026] [security2:error] [pid 1021:tid 1021] [client 149.143.135.210:49277] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 08:33:38.890227 2026] [security2:error] [pid 1021:tid 1021] [client 149.143.135.210:49277] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drainpoultry.com"] [uri "/app/.env"] [unique_id "agm1oq2N4BX5uXlHEu-5AwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-16 05:19:23
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 01:19:10.038433 2026] [security2:error] [pid 14337:tid 14337] [client 149.143.135.210:5291 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 01:19:10.038433 2026] [security2:error] [pid 14337:tid 14337] [client 149.143.135.210:52915] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daviddenotaris.com"] [uri "/.env.orig"] [unique_id "agf-TkSKfsRTC6Ok0zHp1gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:59:43
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:59:09.817311 2026] [security2:error] [pid 11974:tid 11974] [client 149.143.135.210:4632 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:59:09.817311 2026] [security2:error] [pid 11974:tid 11974] [client 149.143.135.210:46325] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brookspowell.com"] [uri "/.env"] [unique_id "agbgXSA-9_VSGji_GWXc_wAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:32:19
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:31:58.856816 2026] [security2:error] [pid 31142:tid 31142] [client 149.143.135.210:3419 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:31:58.856816 2026] [security2:error] [pid 31142:tid 31142] [client 149.143.135.210:34195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dildog.com"] [uri "/.env.development"] [unique_id "agbZ_or3usITrqf3PA9dPwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-05-15 04:34:56
UTC ·
(6 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.135.210 (US/United States/-): 1 in the last 3600 secs (0-193)
Hacking
🇫🇷
masterguru
2026-05-15 04:04:15
UTC ·
(6 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.135.210 (US/United States/-): 1 in the last 3600 secs (0-197)
Hacking
🇺🇸
TPI-Abuse
2026-05-12 12:33:48
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:33:35.866969 2026] [security2:error] [pid 19258:tid 19258] [client 149.143.135.210:3394 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:33:35.866969 2026] [security2:error] [pid 19258:tid 19258] [client 149.143.135.210:33945] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "termites.corepest.com"] [uri "/app/.env"] [unique_id "agMeH-E_6LCeszP-zC5-_AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 11:10:15
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 07:09:51.746142 2026] [security2:error] [pid 14462:tid 14462] [client 149.143.135.210:5550 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 07:09:51.746142 2026] [security2:error] [pid 14462:tid 14462] [client 149.143.135.210:55501] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "r-390.com"] [uri "/.env.local"] [unique_id "agMKfxfIBIO7KNj2vbVCOAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-05-11 13:13:01
UTC ·
(6 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.135.210 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇺🇸
TPI-Abuse
2026-05-11 04:52:40
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:08.285613 2026] [security2:error] [pid 30871:tid 30871] [client 149.143.135.210:4455 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 00:52:08.285613 2026] [security2:error] [pid 30871:tid 30871] [client 149.143.135.210:44557] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pizzadata.com"] [uri "/wp-config.php"] [unique_id "agFgeNKWTawD1zEEsu6BEgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-11 01:29:33
UTC ·
(6 months ago)
(caddyscan) Scanner path probe from 149.143.135.210 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:15:11 +0000] "GET /.env.netlify HT ...
show more
(caddyscan) Scanner path probe from 149.143.135.210 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:15:11 +0000] "GET /.env.netlify HTTP/1.1"
[REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:27:09 +0000] "GET /.env.default HTTP/1.1"
[REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:27:10 +0000] "GET /.env.ci HTTP/1.1"
[REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:29:15 +0000] "GET /actuator/heapdump HTTP/1.1"
[REDACTED] 200 2627 149.143.135.210 - - [11/May/2026:01:29:31 +0000] "GET /.env.demo HTTP/1.1"
show less
Port Scan
🇺🇸
mnsf
2026-05-10 22:05:21
UTC ·
(6 months ago)
Scanning/Probing (21)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 20:02:52
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 16:02:37.023163 2026] [security2:error] [pid 8927:tid 8927] [client 149.143.135.210:48123] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 16:02:37.023163 2026] [security2:error] [pid 8927:tid 8927] [client 149.143.135.210:48123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerloft.com"] [uri "/.env.example"] [unique_id "afueXW88RFuv-QlLU39TawAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack