🇸🇬
cimee
2026-06-03 15:07:53
(3 days ago)
This IP accessed the path /.env_secret, which is banned.
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-14 22:06:14
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-13.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-04-05 05:23:11
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 01:23:00.552281 2026] [security2:error] [pid 13810:tid 13810] [client 172.68.138.176:14048] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazedbyu.com.dcmillerjr.com"] [uri "/.env.example"] [unique_id "adHxtENyYlaWxFG4C88KIAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 14:45:05
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 10:44:57.740362 2026] [security2:error] [pid 15947:tid 15947] [client 172.68.138.176:10559] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cbsproductionsinc.starrmail.net"] [uri "/.git/logs/HEAD"] [unique_id "adEj6fOHaFPA5zrtmhDUVwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 13:54:59
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 09:54:52.223432 2026] [security2:error] [pid 14101:tid 14101] [client 172.68.138.176:13970] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.thebestac.com"] [uri "/app/.env"] [unique_id "adEYLJmo_uolGmJOPOQpdQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 13:06:57
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 09:06:52.076623 2026] [security2:error] [pid 4308:tid 4308] [client 172.68.138.176:9484] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.imageries.net"] [uri "/.envrc"] [unique_id "adEM7C9G7EnmP7Eh8IYnMwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 12:42:19
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 08:42:14.906697 2026] [security2:error] [pid 21198:tid 21198] [client 172.68.138.176:13069] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.networkparanoia.com"] [uri "/.env.production.bak"] [unique_id "adEHJm7DiqrFx4qpfrMBoAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 12:06:06
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 08:06:01.535834 2026] [security2:error] [pid 12334:tid 12334] [client 172.68.138.176:10503] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.shay.org"] [uri "/.env.dist"] [unique_id "adD-qWvAuOo4cvtp21ii4AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 03:33:43
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:33:34.079271 2026] [security2:error] [pid 26399:tid 26399] [client 172.68.138.176:12014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.z-industrial.com"] [uri "/.env~"] [unique_id "adCGjm-ZdVizIbyNxhLFHQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 01:20:32
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 21:20:23.782553 2026] [security2:error] [pid 2660:tid 2660] [client 172.68.138.176:11818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thepenandquill.com"] [uri "/.env.old"] [unique_id "adBnV7tC_2BJ2aEa8ePm4wAAAC8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 21:21:15
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 17:21:07.346585 2026] [security2:error] [pid 22058:tid 22058] [client 172.68.138.176:10596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thewaywework.com"] [uri "/.env.staging"] [unique_id "adAvQ937R-GxKOYJ1C0JoAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 15:46:17
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 11:46:11.557381 2026] [security2:error] [pid 23091:tid 23091] [client 172.68.138.176:11003] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.watsoncousins.net"] [uri "/.env.production.local"] [unique_id "ac_gw3dXU6LsmWH4O5Th-QAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 07:11:25
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 03:11:16.394905 2026] [security2:error] [pid 5370:tid 5370] [client 172.68.138.176:10624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.brookspowell.com"] [uri "/.env.test"] [unique_id "ac9oFI7yPfyW9D72dsONHQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 04:04:21
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 00:04:11.667603 2026] [security2:error] [pid 30396:tid 30396] [client 172.68.138.176:11529] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tipdavid.com"] [uri "/.env.bak"] [unique_id "ac88O5OPij4_W88tB3kP8gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 01:10:55
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.138.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 21:10:47.976313 2026] [security2:error] [pid 26175:tid 26175] [client 172.68.138.176:13159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cabanaconstructionandpaving.com"] [uri "/.env_backup"] [unique_id "ac8Tlz1EXuLzijoXQcQEgAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack