🇩🇪
altenglaner
2026-11-12 00:34:08
UTC ·
(2 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 16:12:30
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 11:12:24.829141 2026] [security2:error] [pid 10955:tid 10955] [client 172.71.172.181:13980] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 11:12:24.829141 2026] [security2:error] [pid 10955:tid 10955] [client 172.71.172.181:13980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wedemandavote.com"] [uri "/.htaccess"] [unique_id "avST6A6q6AY7zXNTSN1gfwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-11-10 16:15:51
UTC ·
(3 days ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:40:41
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:40:30.467922 2026] [security2:error] [pid 3832000:tid 3832017] [client 172.71.172.181:94 ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:40:30.467922 2026] [security2:error] [pid 3832000:tid 3832017] [client 172.71.172.181:9402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tristatepropertymgmt.com"] [uri "/wp-config.php.old"] [unique_id "avL0nmKgAwYZuuuWqcYXdgAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-10 07:14:46
UTC ·
(4 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:21:45
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:21:40.436415 2026] [security2:error] [pid 15983:tid 15983] [client 172.71.172.181:10119] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:21:40.436415 2026] [security2:error] [pid 15983:tid 15983] [client 172.71.172.181:10119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gotdt.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gotdt.com"] [uri "/index.php.bak"] [unique_id "avJjlKjgTBuOMIbnpdK9ZQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-09 23:00:33
UTC ·
(4 days ago)
Blocked by firewall on hugin [8443/tcp] | Rule: UFW | SPT: 25224 | TTL: 57 | LEN: 60 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
TPI-Abuse
2026-11-07 02:06:27
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:06:21.704916 2026] [security2:error] [pid 15701:tid 15701] [client 172.71.172.181:11436] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 21:06:21.704916 2026] [security2:error] [pid 15701:tid 15701] [client 172.71.172.181:11436] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tactara.net"] [uri "/.env.dev"] [unique_id "au6HnYKrbgKNyVVbXIJxHwAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 15:15:41
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 10:15:35.469815 2026] [security2:error] [pid 15977:tid 15977] [client 172.71.172.181:13919] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 10:15:35.469815 2026] [security2:error] [pid 15977:tid 15977] [client 172.71.172.181:13919] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "taacorp.com"] [uri "/.env.local"] [unique_id "auydl_UTBpOvpGEyBoD_WgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 23:38:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 18:38:19.399841 2026] [security2:error] [pid 16758:tid 16758] [client 172.71.172.181:13125] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.172.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 18:38:19.399841 2026] [security2:error] [pid 16758:tid 16758] [client 172.71.172.181:13125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "holdingfamily.com"] [uri "/.env.save"] [unique_id "auvB6wdp9n473I7ecod7kQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-11-01 09:30:37
UTC ·
(1 week ago)
Web App Attack
🇫🇷
mom199
2026-10-31 16:09:45
UTC ·
(1 week ago)
BotNext VPS Kernel Armor: Automated vulnerability scan & sensitive path probe dropped (HTTP 444).
Bad Web Bot
Web App Attack
Anonymous
2026-10-29 21:03:25
UTC ·
(2 weeks ago)
Blocked by firewall on hugin [8443/tcp] | Rule: UFW | SPT: 21753 | TTL: 57 | LEN: 60 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
Anonymous
2026-10-28 11:12:12
UTC ·
(2 weeks ago)
(caddyscan) Scanner path probe from 172.71.172.181 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:09:56 +0000] "GET /.env.staging HTTP/1.1"
...
show more
(caddyscan) Scanner path probe from 172.71.172.181 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:09:56 +0000] "GET /.env.staging HTTP/1.1"
[REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:10:02 +0000] "GET /.env.sample HTTP/1.1"
[REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:11:09 +0000] "GET /home/ec2-user/.env HTTP/1.1"
[REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:11:42 +0000] "GET /home/ec2-user/bin/.env HTTP/1.1"
[REDACTED] 200 2627 172.71.172.181 - - [28/Oct/2026:11:12:09 +0000] "GET /twilio/credentials/.env HTTP/1.1"
show less
Port Scan
Anonymous
2026-10-25 20:40:42
UTC ·
(2 weeks ago)
Blocked by firewall on hugin [8443/tcp] | Rule: UFW | SPT: 22186 | TTL: 57 | LEN: 60 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan