🇩🇪
IVski
2026-08-22 12:54:50
(17 hours ago)
IVski WAF | Sensitive file probe - looking for exposed .env.dist
Hacking
Brute-Force
Web App Attack
🇧🇪
madeit
2026-08-20 13:55:52
(2 days ago)
Web App Attack
🇩🇪
Zydzy
2026-05-14 14:08:26
(3 months ago)
Automated attack detected. Server: 95.140.154.181. Jail: nginx-scanner.
Web App Attack
🇺🇸
mnsf
2026-04-03 20:05:57
(4 months ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 06:13:29
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 02:13:22.097732 2026] [security2:error] [pid 12129:tid 12129] [client 172.68.245.15:13351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.fatcavemedia.com"] [uri "/.envrc"] [unique_id "actmAsUKu80gqiPUTjS_IgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 02:43:54
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 22:43:48.832854 2026] [security2:error] [pid 799152:tid 799152] [client 172.68.245.15:13329] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.firstexplorer.us"] [uri "/.envrc"] [unique_id "acs05CA1O_7bAJk5VDfYQgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 18:41:24
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 14:41:20.885709 2026] [security2:error] [pid 7574:tid 7574] [client 172.68.245.15:11094] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.dbfitwell.com"] [uri "/.env~"] [unique_id "acrD0Cx_ya-UkD7mdlOt6gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 18:10:32
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 14:10:26.823621 2026] [security2:error] [pid 13256:tid 13256] [client 172.68.245.15:12122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ladymcollection.com"] [uri "/.env.save"] [unique_id "acq8krcRiMJMgsY41yGTuQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 12:42:39
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 08:42:31.251886 2026] [security2:error] [pid 28210:tid 28210] [client 172.68.245.15:11379] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jdeloa.billiardlifetapleague.com"] [uri "/.env.production"] [unique_id "acpvt-rtjQbo-twS6BexQgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 09:42:34
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 05:42:28.616676 2026] [security2:error] [pid 22907:tid 22907] [client 172.68.245.15:12461] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.stonetarot.com"] [uri "/.env_backup"] [unique_id "acpFhDvhzWe75eBmndp25wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 08:25:09
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 04:24:58.994191 2026] [security2:error] [pid 8211:tid 8211] [client 172.68.245.15:12570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.jeanlouisdarville.com"] [uri "/.env.production.local"] [unique_id "acozWrIQKclPZNau3SvKfAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 07:38:40
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 03:38:33.309357 2026] [security2:error] [pid 11659:tid 11659] [client 172.68.245.15:12758] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.muskogeecleaning.com"] [uri "/.env.production.local"] [unique_id "acooeWMfbZymtZNBWRnFbgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 06:02:46
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 02:02:39.037484 2026] [security2:error] [pid 4359:tid 4359] [client 172.68.245.15:13451] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.drwolberg.com"] [uri "/private/.env"] [unique_id "acoR__eGbO5mBYFlvtWFtAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 04:31:33
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 00:31:28.474756 2026] [security2:error] [pid 30812:tid 30812] [client 172.68.245.15:14195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.billdavidow.com"] [uri "/.env.bak"] [unique_id "acn8oGAxKJm5kqAsTOqnCQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 04:03:29
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 00:03:25.135305 2026] [security2:error] [pid 22591:tid 22591] [client 172.68.245.15:9513] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.c470techarchive.net"] [uri "/.env.local.backup"] [unique_id "acn2DVxNJ3Yy9xccnGPxjgAAAC4"]
show less
Brute-Force
Bad Web Bot
Web App Attack