🇿🇦
maximonline.co.za
2026-04-09 08:14:09
(2 months ago)
Brute Force SMTP AUTH Attack
Brute-Force
🇳🇱
jjnxpct
2026-03-25 05:16:16
(2 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /.env]
show less
Web App Attack
Hacking
🇺🇸
octageeks.com
2026-03-25 04:08:12
(2 months ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
mnsf
2026-03-24 17:05:49
(3 months ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-24 16:40:45
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 12:40:17.599359 2026] [security2:error] [pid 14274:tid 14313] [client 181.215.182.169:10793] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tamarkummel.com"] [uri "/.env"] [unique_id "acK-cWLsxGclLh0H-hr9mgAAAU0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SLSLLC
2026-03-24 16:12:43
(3 months ago)
181.215.182.169 - - [24/Mar/2026:16:12:36 +0000] "GET /.env HTTP/2.0" 403 1927 "-" "Mozilla/5.0 (Mac ...
show more
181.215.182.169 - - [24/Mar/2026:16:12:36 +0000] "GET /.env HTTP/2.0" 403 1927 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-24 16:11:40
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 12:11:35.638892 2026] [security2:error] [pid 7515:tid 7515] [client 181.215.182.169:63163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebronsons.com"] [uri "/.env"] [unique_id "acK3t4dJ3DOCx0fQKK9YjgAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-24 15:38:53
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 181.215.182.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 11:38:44.950589 2026] [security2:error] [pid 24682:tid 24682] [client 181.215.182.169:1505] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.instepdogobedience.com"] [uri "/.env"] [unique_id "acKwBKSPSulm5MkCHy1lUQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
poundawebsiteltd
2026-03-24 15:35:42
(3 months ago)
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:80 181.215.182.169 - - [24/Mar/2026: ...
show more
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:80 181.215.182.169 - - [24/Mar/2026:15:35:40 +0000] GET /.env HTTP/1.1 403 214 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
show less
Web App Attack
🇺🇸
myagent.site
2026-03-24 15:12:12
(3 months ago)
Blocking for trying to access an exploit file: /.env
Hacking
🇦🇺
AWW-Admin
2026-03-24 15:09:42
(3 months ago)
(mod_security) mod_security triggered on hostname [redacted] 181.215.182.169 (US/United States/-)
SQL Injection
🇷🇺
DZBOT
2026-03-24 15:06:45
(3 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
kosada.com
2026-03-24 14:54:48
(3 months ago)
Web vulnerability probing: /.env
Web App Attack
🇺🇸
S.O.B.A. Dev.
2026-03-24 14:50:02
(3 months ago)
Threat Blocked by BeeHive from (ASN:174) (Network:COGENT-174 - Cogent Communications, LLC) (Host:sob ...
show more
Threat Blocked by BeeHive from (ASN:174) (Network:COGENT-174 - Cogent Communications, LLC) (Host:soba.dev) (Method:GET) (Protocol:HTTP/1.1) (Timestamp:2026-03-24T14:50:02Z)
show less
Brute-Force
Web Spam
Web App Attack
🇦🇺
Anytech
2026-03-24 14:46:44
(3 months ago)
Blocked by conn-monitor: Rule sensitive-config-and-file-exposure: Detect probing for sensitive appli ...
show more
Blocked by conn-monitor: Rule sensitive-config-and-file-exposure: Detect probing for sensitive application, cloud, and version control configuration files, logs, and credentials, including .env, config.json, cloud credentials, aws.yml, and config.yml. (1 hits)
show less
Web App Attack