2026-07-29 07:00:00
UTC ·
(3 months ago)
Apache probe; attempts=201; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /.e ...
show more
Apache probe; attempts=201; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.json | /.env.live | /.env.local | /.env.old | /.env.preprod | /.env.prod | /.env.production | /.env.remote | /.env.sample | /.env.save | /.env.stage | /.env.staging | /.env.swp | /.env.test | /.env.txt | /.env.uat | /.env.yml | /.env~ | /.git/.env | /.git/config | /actions/.env | /admin-panel/.env | /admin/.env | /administrator/.env | /angular/.env | /ansible/.env | /api/.env | /api/dev/.env | /api/staging/.env | /api/v1/.env | /api/v2/.env | /api/v3/.env | /app/.env | /application/.env | /apps/.env | /assets/.env | /aws/.env | /azure/.env | /backup/.env | /backups/.env | /beta/.env | /bin/.env | /bootstrap/.env | /brevo/.env | /build/.env | /buildkite/.env | /bulk/.env | /cache/.env | /cakephp/.env | /campaign | ... [201 exact paths total]
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 07:38:18
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:38:12.981213 2026] [security2:error] [pid 5 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 03:38:12.981213 2026] [security2:error] [pid 53802:tid 53802] [client 18.223.212.8:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcbrude.com"] [uri "/.env.txt"] [unique_id "amcK5IA2WCYKJDj4gzbVEwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 06:57:41
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:57:37.051656 2026] [security2:error] [pid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:57:37.051656 2026] [security2:error] [pid 3912721:tid 3912721] [client 18.223.212.8:42656] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcarrollcommunications.com"] [uri "/.git/config"] [unique_id "amcBYTz2AzFQ6slnNKy5NQAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 06:06:03
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:05:54.741273 2026] [security2:error] [pid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 02:05:54.741273 2026] [security2:error] [pid 16340:tid 16340] [client 18.223.212.8:38508] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcacpas.com"] [uri "/.git/config"] [unique_id "amb1QhrC9FwUHN2f1YaNHgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
MatCat
2026-07-27 06:05:07
UTC ·
(3 months ago)
Banned by fail2ban: apache-webprobe
Port Scan
Bad Web Bot
🇺🇸
alecj.com
2026-07-27 04:20:53
UTC ·
(3 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/appsec-vpatch
Web App Attack
🇳🇱
e.fierstra
2026-07-26 02:12:51
UTC ·
(3 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-07-25 22:04:27
UTC ·
(3 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-24.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-07-25 03:35:42
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 23:35:38.978110 2026] [security2:error] [pid 2 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 23:35:38.978110 2026] [security2:error] [pid 28916:tid 28916] [client 18.223.212.8:39404] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "manb.org"] [uri "/.git/config"] [unique_id "amQvCnYPIPAlUYpwGATjiQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-07-25 02:05:03
UTC ·
(3 months ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-07-24 22:04:05
UTC ·
(3 months ago)
Auto-ban: >3000 req/min op 2026-07-24
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-07-24 10:18:37
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 06:18:31.843892 2026] [security2:error] [pid 2 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 06:18:31.843892 2026] [security2:error] [pid 24144:tid 24144] [client 18.223.212.8:51616] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "parasolia.angelabcomics.com"] [uri "/.git/config"] [unique_id "amM79x3h5V_5xO6MdJR1LAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 09:27:28
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:27:24.705238 2026] [security2:error] [pid 6 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:27:24.705238 2026] [security2:error] [pid 616260:tid 616260] [client 18.223.212.8:42878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paragontechusa.com"] [uri "/.git/config"] [unique_id "amMv_PwhiXC3_hZy7FzCnAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rip
2026-07-24 08:17:28
UTC ·
(3 months ago)
Remote Command Execution - Unix Shell Expression Found in URI
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 08:14:04
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 04:13:56.985632 2026] [security2:error] [pid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 18.223.212.8 (ec2-18-223-212-8.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 04:13:56.985632 2026] [security2:error] [pid 3608402:tid 3608402] [client 18.223.212.8:43208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pappakotis.net"] [uri "/.git/config"] [unique_id "amMexOv__xQLzpWnvLPiVAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack