🇺🇸
TPI-Abuse
2026-01-08 00:21:54
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 19:21:50.994305 2026] [security2:error] [pid 19151:tid 19167] [client 168.119.64.101:42224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marinkovich.info"] [uri "/.env.production"] [unique_id "aV74nlJKRU_30uz-cT1JvQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-01-07 22:59:38
(4 months ago)
Auto-ban: >3000 req/min op 2026-01-07
Hacking
Web App Attack
SSH
🇺🇸
SLSLLC
2026-01-07 22:45:22
(4 months ago)
168.119.64.101 - - [07/Jan/2026:22:45:21 +0000] "GET /.env.save HTTP/2.0" 403 1927 "-" "Mozilla/5.0 ...
show more
168.119.64.101 - - [07/Jan/2026:22:45:21 +0000] "GET /.env.save HTTP/2.0" 403 1927 "-" "Mozilla/5.0 (X11; Linux x86_64)"
...
show less
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-01-07 22:28:56
(4 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-01-07 20:48:53
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 15:48:50.059922 2026] [security2:error] [pid 31185:tid 31185] [client 168.119.64.101:52972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.phoenixchicagorealty.com"] [uri "/.env.local"] [unique_id "aV7GsmllNxFAN5Ou_EnitAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-07 20:12:34
(4 months ago)
Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1, GET /.env.save/ HTTP/1.1, GET /.env.prod ...
show more
Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1, GET /.env.save/ HTTP/1.1, GET /.env.production/ HTTP/1.1, GET /.env.local/ HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.production HTTP/1.1, GET /app/.env HTTP/1.1, GET /.env.save HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-01-07 19:05:11
(4 months ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
myagent.site
2026-01-07 17:31:46
(4 months ago)
Blocking for trying to access an exploit file: /.env.local
Hacking
🇺🇸
TPI-Abuse
2026-01-07 14:25:09
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 09:25:04.795656 2026] [security2:error] [pid 5794:tid 5794] [client 168.119.64.101:49524] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "riversidecabinswv.com"] [uri "/.env.local"] [unique_id "aV5swJ-_uZUqxqLGEOPSzQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-01-07 13:17:20
(4 months ago)
Probing websites for vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-01-07 11:39:38
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 06:39:32.048199 2026] [security2:error] [pid 19545:tid 19545] [client 168.119.64.101:59108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apuntesdeinversion.com"] [uri "/.env.save"] [unique_id "aV5F9CUzPb6zo8g-fvDAZgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-07 07:44:58
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 02:44:53.412554 2026] [security2:error] [pid 14097:tid 14097] [client 168.119.64.101:49436] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kronrod.com"] [uri "/.env.save"] [unique_id "aV4O9VtZQSRbLqOwBfRjjwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-01-07 06:57:10
(4 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-01-07 05:46:08
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 00:46:03.809361 2026] [security2:error] [pid 20437:tid 20437] [client 168.119.64.101:56876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bowdens-landing.com"] [uri "/.env.production"] [unique_id "aV3zGyKZ91dZl0AGRF7MVgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-07 02:13:06
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the ...
show more
(mod_security) mod_security (id:210492) triggered by 168.119.64.101 (ns1.sslsecure.co.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 06 21:13:02.714547 2026] [security2:error] [pid 2395476:tid 2395500] [client 168.119.64.101:36128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fayleuzzi.com"] [uri "/.env.local"] [unique_id "aV3BLjJvmSGMWY2OiYuSdQAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack