🇺🇸
TPI-Abuse
2026-06-02 16:31:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 12:31:33.171867 2026] [security2:error] [pid 26189:tid 26189] [client 151.106.116.229:20706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rangerroma.com"] [uri "/dev/.env"] [unique_id "ah8FZW2CQtwkDlYGAXRjhQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
Ivo Vynckier
2026-06-02 13:49:00
(1 day ago)
151.106.116.229 - - [02/Jun/2026:11:46:57 +0200] "GET /new/.env HTTP/1.1" 403 560 "-" "Mozilla/5.0 ( ...
show more
151.106.116.229 - - [02/Jun/2026:11:46:57 +0200] "GET /new/.env HTTP/1.1" 403 560 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
151.106.116.229 - - [02/Jun/2026:11:46:57 +0200] "GET /app/.env HTTP/1.1" 403 560 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
151.106.116.229 - - [02/Jun/2026:11:46:57 +0200] "GET /.env HTTP/1.1" 403 560 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
show less
Web App Attack
🇩🇪
paissangroup
2026-06-02 12:42:45
(1 day ago)
Multiple WAF Violations
Web App Attack
🇬🇧
Apache
2026-06-02 12:26:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (SG/Singapore/-): 5 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (SG/Singapore/-): 5 in the last 300 secs (CF_ENABLE)
show less
Brute-Force
Web App Attack
2026-06-02 11:01:30
(1 day ago)
[da.kdns.gr] httpd-suspicious-path: sites=akraion.com; logs=/var/log/httpd/domains/akraion.com.log; ...
show more
[da.kdns.gr] httpd-suspicious-path: sites=akraion.com; logs=/var/log/httpd/domains/akraion.com.log; samples=/app/.env | /member/.env | /admin/.env
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 11:00:51
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 07:00:47.305216 2026] [security2:error] [pid 19630:tid 19630] [client 151.106.116.229:32922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "akramansari.com"] [uri "/core/.env"] [unique_id "ah6330HVxz3NHXjfnUypJwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 07:27:58
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 03:27:51.346740 2026] [security2:error] [pid 6057:tid 6057] [client 151.106.116.229:60180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "2pollards.com"] [uri "/api/.env"] [unique_id "ah6F9xPR5InPkx-IzG1bzwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-02 06:16:26
(1 day ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
2026-06-02 04:09:51
(1 day ago)
(caddyscan) Scanner path probe from 151.106.116.229 (SG/Singapore/-): 5 in the last 3600 secs; Ports ...
show more
(caddyscan) Scanner path probe from 151.106.116.229 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 151.106.116.229 - - [02/Jun/2026:04:09:46 +0000] "GET /backend/.env HTTP/1.1"
[REDACTED] 200 2627 151.106.116.229 - - [02/Jun/2026:04:09:46 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 151.106.116.229 - - [02/Jun/2026:04:09:46 +0000] "GET /member/.env HTTP/1.1"
[REDACTED] 200 2627 151.106.116.229 - - [02/Jun/2026:04:09:46 +0000] "GET /core/.env HTTP/1.1"
[REDACTED] 200 2627 151.106.116.229 - - [02/Jun/2026:04:09:46 +0000] "GET /dev/.env HTTP/1.1"
show less
Port Scan
🇬🇧
consul.to
2026-06-02 02:30:18
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-02 02:26:01
(1 day ago)
[Tue Jun 02 12:26:00.595699 2026] [security2:error] [pid 181948] [client 151.106.116.229:41906] [cli ...
show more
[Tue Jun 02 12:26:00.595699 2026] [security2:error] [pid 181948] [client 151.106.116.229:41906] [client 151.106.116.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dlcarterauthor.com"] [uri "/dev/.env"] [unique_id "ah4_OPfV4_9FpRLYGvRoLQAAAAE"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 01:51:11
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 21:51:08.380993 2026] [security2:error] [pid 8166:tid 8166] [client 151.106.116.229:28594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bryanthebusinessmanager.com"] [uri "/.env"] [unique_id "ah43DB1nWtpR1cMQe3YBygAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 01:15:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 21:15:01.013607 2026] [security2:error] [pid 11791:tid 11791] [client 151.106.116.229:20812] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "messengersforchrist.com"] [uri "/api/.env"] [unique_id "ah4ulTce_TBpFK1yyIqmxAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 00:52:38
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 20:52:32.630301 2026] [security2:error] [pid 4226:tid 4236] [client 151.106.116.229:31070] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "swizzlestick.com"] [uri "/admin/.env"] [unique_id "ah4pUOfkHVfDbuPM4C6-FAAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 00:35:58
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 151.106.116.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 20:35:51.183243 2026] [security2:error] [pid 26695:tid 26695] [client 151.106.116.229:37586] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pkermis.com"] [uri "/member/.env"] [unique_id "ah4lZ0OZxiJuWP2LzElomQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack