2026-10-08 04:05:49
(1 day ago)
IP matched detection query many 3xx errors.
Brute-Force
🇧🇪
madeit
2026-10-05 22:57:05
(3 days ago)
Web App Attack
🇳🇴
jad-abuse
2026-07-04 02:42:23
(3 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: tomcat_ma ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: tomcat_manager. Observed by 1 sensor(s); 1 hits.
show less
Hacking
Web App Attack
🇺🇸
mawan
2026-06-24 21:01:54
(3 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
TPI-Abuse
2026-04-05 11:39:16
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 07:39:09.564540 2026] [security2:error] [pid 12587:tid 12587] [client 172.68.138.144:13089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.berklie.com"] [uri "/.env~"] [unique_id "adJJ3SOUdC9HhYWSXLNO2gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 21:52:39
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 17:52:34.731025 2026] [security2:error] [pid 28038:tid 28038] [client 172.68.138.144:12388] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.hpepaper.com"] [uri "/config/.env"] [unique_id "adGIIm93pbSMJLG17K7HrgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 17:41:18
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 13:41:13.580886 2026] [security2:error] [pid 32056:tid 32056] [client 172.68.138.144:10825] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ibiocat.com"] [uri "/.env.dev"] [unique_id "adFNOSp_yyaaTU_IudEG1gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 02:57:29
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 22:57:20.418090 2026] [security2:error] [pid 5507:tid 5507] [client 172.68.138.144:10649] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kanata.ws"] [uri "/.env.production.local"] [unique_id "adB-EFrhFp6CtM1muG2LoAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 17:19:03
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 13:18:54.924534 2026] [security2:error] [pid 7327:tid 7327] [client 172.68.138.144:10639] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daikin.cloudex.link"] [uri "/.env.development"] [unique_id "ac_2fl3deBUvWP2yGfnLrgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 08:35:15
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 04:35:08.210773 2026] [security2:error] [pid 12884:tid 12884] [client 172.68.138.144:9499] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "souldata.com"] [uri "/.env.development.local"] [unique_id "ac97vDp8YYyGzqECZNxMUQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 07:46:31
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 03:46:24.511355 2026] [security2:error] [pid 20042:tid 20042] [client 172.68.138.144:10932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lspfest.com"] [uri "/.env.old"] [unique_id "ac9wUDQVAeQAE1Gd09pIkQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 07:16:38
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 03:16:33.819250 2026] [security2:error] [pid 27657:tid 27657] [client 172.68.138.144:9514] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.jimmyshakes.org"] [uri "/.env.backup"] [unique_id "ac9pUdIJS1NqW1Lsv3KITgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 03:25:36
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 23:25:19.572563 2026] [security2:error] [pid 26181:tid 26181] [client 172.68.138.144:9334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.chicagowca.com"] [uri "/.env.development.local"] [unique_id "ac8zH3EHAGWS4U5N4RGb4gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 22:22:07
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 18:22:03.545525 2026] [security2:error] [pid 32639:tid 32639] [client 172.68.138.144:11052] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.tribwatch.com"] [uri "/.env.test"] [unique_id "ac7sC_VMZa2n1-CPMCjk5AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 21:07:28
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 17:06:48.588236 2026] [security2:error] [pid 30354:tid 30354] [client 172.68.138.144:10944] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.pozzolan.org"] [uri "/.env.local"] [unique_id "ac7aaM06JvnPyPuS_mVSbQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
