🇺🇸
TPI-Abuse
2026-11-04 22:23:34
(4 minutes ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:23:28.973347 2026] [security2:error] [pid 8287:tid 8287] [client 187.40.234.142:41244] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 17:23:28.973347 2026] [security2:error] [pid 8287:tid 8287] [client 187.40.234.142:41244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "grampys.toys"] [uri "/.env"] [unique_id "auuwYMZOXdfOz2sCOkSuoAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
SkyDancer
2026-11-04 22:08:10
(19 minutes ago)
Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X).
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-04 20:05:20
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:05:16.490288 2026] [security2:error] [pid 14136:tid 14136] [client 187.40.234.142:16034] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:05:16.490288 2026] [security2:error] [pid 14136:tid 14136] [client 187.40.234.142:16034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "halleycpa.com"] [uri "/.env"] [unique_id "auuP_MEFuQhJuTOrmbqqKQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 19:29:12
(2 hours ago)
(mod_security) mod_security (id:949110) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:29:04.937660 2026] [security2:error] [pid 26790:tid 26790] [client 187.40.234.142:28920] ...
show more
(mod_security) mod_security (id:949110) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 14:29:04.937660 2026] [security2:error] [pid 26790:tid 26790] [client 187.40.234.142:28920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hallemann.com"] [uri "/.env"] [unique_id "auuHgGhoPXtDSkmxy3ikfQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-04 15:42:47
(6 hours ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 187.40.234.142 - - [04/Nov/2026:16:42:46 +0100] "GET /.env HTTP/1.1" 301 493 "-" "python-requests/2.32.4"
...
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-11-04 15:18:01
(7 hours ago)
(mod_security) mod_security (id:949110) triggered by 187.40.234.142 (US/United States/-): N in the last X secs
Web App Attack
🇳🇿
Tripwire
2026-11-04 13:09:38
(9 hours ago)
Scanning for exploits - /.env
Web App Attack
🇺🇸
WellSpring
2026-11-04 13:00:35
(9 hours ago)
env leak on wellspr.ing/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 12:23:26
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 07:23:22.229390 2026] [security2:error] [pid 7570:tid 7570] [client 187.40.234.142:18050] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 07:23:22.229390 2026] [security2:error] [pid 7570:tid 7570] [client 187.40.234.142:18050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "homecheckinmaine.com"] [uri "/.env"] [unique_id "ausjurzsnmbiW3bAkhbFQwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 10:09:36
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 05:09:31.340567 2026] [security2:error] [pid 4276:tid 4276] [client 187.40.234.142:19510] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 05:09:31.340567 2026] [security2:error] [pid 4276:tid 4276] [client 187.40.234.142:19510] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "homebuilt.org"] [uri "/.env"] [unique_id "ausEWxYW_v3G9BHBUgf4NAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-01 22:59:21
(2 days ago)
Auto-ban: >3000 req/min op 2026-11-01
Web App Attack
SSH
Hacking
2026-11-01 19:24:04
(3 days ago)
Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 18:34:46
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:34:39.431615 2026] [security2:error] [pid 1424:tid 1424] [client 187.40.234.142:50838] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:34:39.431615 2026] [security2:error] [pid 1424:tid 1424] [client 187.40.234.142:50838] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "holboxwhalesharktours.net"] [uri "/.env"] [unique_id "aueGP8hSPoTsvZXs3sdqAwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-01 18:18:43
(3 days ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 187.40.234.142 - - \[01/Nov/2026:19:18:39 +0100\] "GET /.env HTTP/1.1" 301 597 "-" "python-requests/2.32.4"
...
Bad Web Bot
Web App Attack
🇪🇸
bohl-aiG5aef
2026-11-01 15:02:44
(3 days ago)
Suricata Alert [SID:2031502] ET INFO Request to Hidden Environment File - Inbound
Hacking
