🇺🇸
TPI-Abuse
2026-01-08 07:54:38
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 08 02:54:32.193044 2026] [security2:error] [pid 6170:tid 6170] [client 185.177.72.67:34558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.client.jamesallenwalker.com"] [uri "/.env.production"] [unique_id "aV9iuIDxJVngYNn-zK1LGAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
Francisco Vallejo
2026-01-08 07:49:03
(4 months ago)
[Thu Jan 08 08:48:45.548261 2026] [authz_core:error] [pid 296241:tid 128471841883840] [client 185.17 ...
show more
[Thu Jan 08 08:48:45.548261 2026] [authz_core:error] [pid 296241:tid 128471841883840] [client 185.177.72.67:58166] AH01630: client denied by server configuration: proxy:ws://localhost:8081/
[Thu Jan 08 08:48:49.799685 2026] [authz_core:error] [pid 296241:tid 128471833491136] [client 185.177.72.67:49342] AH01630: client denied by server configuration: proxy:ws://localhost:8081/.env.local
[Thu Jan 08 08:48:52.558120 2026] [authz_core:error] [pid 296241:tid 128473175680704] [client 185.177.72.67:49348] AH01630: client denied by server configuration: proxy:ws://localhost:8081/.env.production
[Thu Jan 08 08:48:56.097655 2026] [authz_core:error] [pid 296241:tid 128472940803776] [client 185.177.72.67:49362] AH01630: client denied by server configuration: proxy:ws://localhost:8081/.env.bak
[Thu Jan 08 08:48:57.949304 2026] [authz_core:error] [pid 296241:tid 128472898840256] [client 185.177.72.67:63614] AH01630: client denied by server configuration: proxy:ws://localhost:8081/.env.old
...
show less
Brute-Force
SSH
🇧🇬
Stoyko Stoykov
2026-01-08 07:41:38
(4 months ago)
185.177.72.67 - - [08/Jan/2026:09:41:37 +0200] "GET /.env.production HTTP/1.1" 301 162 "-" "Mozilla/ ...
show more
185.177.72.67 - - [08/Jan/2026:09:41:37 +0200] "GET /.env.production HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Hacking
Web App Attack
🇫🇷
COMAITE
2026-01-08 06:33:51
(4 months ago)
Suspicious URL access.
Web App Attack
🇵🇱
IROK
2026-01-08 05:42:42
(4 months ago)
Firewall Blocked - Unauthorized Port Scanning
...
Port Scan
🇲🇾
Rizzy
2026-01-08 05:30:06
(4 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-01-08 05:23:25
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 08 00:23:17.652052 2026] [security2:error] [pid 3902613:tid 3902625] [client 185.177.72.67:45302] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.callaplusfirst.uoexpanse.com"] [uri "/.env.local"] [unique_id "aV8_RffoxZGBL6Iv-rf2HAAAAEk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
poundawebsiteltd
2026-01-08 05:19:49
(4 months ago)
Apache 403 Forbidden Access. Evidence: [REDACTED_DOMAIN]:80 185.177.72.67 - - [08/Jan/2026:05:19:46 ...
show more
Apache 403 Forbidden Access. Evidence: [REDACTED_DOMAIN]:80 185.177.72.67 - - [08/Jan/2026:05:19:46 +0000] GET /.env.bak HTTP/1.1 403 177 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
show less
Web App Attack
🇩🇪
juutis
2026-01-08 05:13:37
(4 months ago)
Multiple WAF abuses - IP blocked
Hacking
Brute-Force
Web App Attack
🇩🇪
ger-stg-sifi1
2026-01-08 05:03:17
(4 months ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
big-cloud.nl
2026-01-08 05:00:43
(4 months ago)
Try to access /.git/config
Web App Attack
🇦🇺
Anytech
2026-01-08 04:54:14
(4 months ago)
Fail2ban: apache-head-probing - 5 attempts
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-01-08 04:52:01
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 185.177.72.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 07 23:51:56.512786 2026] [security2:error] [pid 1550684:tid 1550684] [client 185.177.72.67:37752] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adelaidapacific.com"] [uri "/.env.bak"] [unique_id "aV837DMMD7-MUVqsDNyLLwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-08 04:45:13
(4 months ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-01-08 04:41:28
(4 months ago)
Web vulnerability probing: /.env.bak
Web App Attack