🇺🇸
TPI-Abuse
2026-10-21 19:11:06
(25 minutes ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 15:11:01.575853 2026] [security2:error] [pid 21725:tid 21725] [client 187.40.234.130:36326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "incrp.org"] [uri "/.env"] [unique_id "atkORTDJQy0MSJj3Kd5xPwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-10-21 18:55:39
(40 minutes ago)
Inbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110- ...
show more
Inbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110-122)
show less
Hacking
🇺🇸
etu brutus
2026-10-21 18:40:00
(56 minutes ago)
187.40.234.130 has been banned for [WebApp Pipeline]
...
Hacking
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-21 18:21:40
(1 hour ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 17:54:07
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 13:54:01.791244 2026] [security2:error] [pid 29037:tid 29037] [client 187.40.234.130:64214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intermixx.com"] [uri "/.env"] [unique_id "atj8OTpuMgeV8VkcjQu_SgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 16:43:48
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 12:43:43.570025 2026] [security2:error] [pid 15129:tid 15129] [client 187.40.234.130:5962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greencornokies.org"] [uri "/.env"] [unique_id "atjrv-sHXp2PN4PNwm7G4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 16:18:06
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 12:18:01.245953 2026] [security2:error] [pid 6594:tid 6704] [client 187.40.234.130:58154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "interludes.info"] [uri "/.env"] [unique_id "atjluVMSqUWYy7DSUDJT8QAAAhE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-21 15:42:00
(3 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 15:21:49
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 11:21:42.981981 2026] [security2:error] [pid 6264:tid 6278] [client 187.40.234.130:57744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greencitymethods.com"] [uri "/.env"] [unique_id "atjYhh9b0XEL2HFIHNISmgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-10-21 15:11:49
(4 hours ago)
80,443
Brute-Force
SSH
🇳🇱
Alt255
2026-10-21 12:45:35
(6 hours ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 187 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 187.40.234.130 - - \[21/Oct/2026:14:45:25 +0200\] "GET /.env HTTP/1.1" 301 489 "-" "python-requests/2.32.4"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 11:48:29
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 07:48:22.112043 2026] [security2:error] [pid 3859:tid 3859] [client 187.40.234.130:51774] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "goepf.com"] [uri "/.env"] [unique_id "atimhn7FjJjMGtsdvfRgewAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-21 08:33:34
(11 hours ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 187.40.234.130 - - [21/Oct/2026:10:33:24 +0200] "GET /.env HTTP/1.1" 301 567 "-" "python-requests/2.32.4"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-21 08:24:03
(11 hours ago)
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 187.40.234.130 (US/United States ...
show more
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 187.40.234.130 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 03:55:11
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 23:55:07.823696 2026] [security2:error] [pid 14014:tid 14014] [client 187.40.234.130:35562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "godscreationobservatory.com"] [uri "/.env"] [unique_id "atg3mzqStkqeS-QXVW2aFwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
