🇺🇸
TPI-Abuse
2026-11-06 15:13:59
UTC ·
(34 minutes ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:13:53.720682 2026] [security2:error] [pid 4944:tid 4944] [client 187.40.234.148:59326] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:13:53.720682 2026] [security2:error] [pid 4944:tid 4944] [client 187.40.234.148:59326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uniquelaos.com"] [uri "/.env"] [unique_id "au3usZ3pVLP2IXBMqQ62WQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 13:49:05
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:49:00.301839 2026] [security2:error] [pid 28844:tid 28844] [client 187.40.234.148:18062] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:49:00.301839 2026] [security2:error] [pid 28844:tid 28844] [client 187.40.234.148:18062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "therustedtree.com"] [uri "/.env"] [unique_id "au3azJ2-P1yGvWgUiBwK6AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 12:15:00
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:14:55.552192 2026] [security2:error] [pid 6179:tid 6179] [client 187.40.234.148:46644] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 07:14:55.552192 2026] [security2:error] [pid 6179:tid 6179] [client 187.40.234.148:46644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toptek.com"] [uri "/.env"] [unique_id "au3Ev2iE9mITbTr4pLx_bwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 11:34:04
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:33:57.780160 2026] [security2:error] [pid 9498:tid 9498] [client 187.40.234.148:28112] M ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 06:33:57.780160 2026] [security2:error] [pid 9498:tid 9498] [client 187.40.234.148:28112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tipdavid.com"] [uri "/.env"] [unique_id "au27JXVdwujbiM1ZklkYlQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
TheCoon
2026-11-06 11:20:31
UTC ·
(4 hours ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇦
danieljamesbertrand
2026-11-06 10:10:17
UTC ·
(5 hours ago)
fail2ban jail=scanner-permanent on canadapaywall.com (automatic report; categories 19,21)
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-11-06 08:05:45
UTC ·
(7 hours ago)
[06/Nov/2026:10:05:44 +0200] -- 187.40.234.148 Ban reason: User-Agent python-requests
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-11-06 07:24:30
UTC ·
(8 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 1 hits.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:26:13
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:26:06.127060 2026] [security2:error] [pid 15259:tid 15259] [client 187.40.234.148:5778] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:26:06.127060 2026] [security2:error] [pid 15259:tid 15259] [client 187.40.234.148:5778] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "topsecret-si.com"] [uri "/.env"] [unique_id "au1IzkulsA3HODowhM_WxgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-06 02:36:02
UTC ·
(13 hours ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 187.40.234.148 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 01:42:02
UTC ·
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:41:57.826622 2026] [security2:error] [pid 26545:tid 26545] [client 187.40.234.148:38266] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:41:57.826622 2026] [security2:error] [pid 26545:tid 26545] [client 187.40.234.148:38266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unionega.com"] [uri "/.env"] [unique_id "au0wZbBUIzMVlUjYqIzqhAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
Jova
2026-11-06 01:41:58
UTC ·
(14 hours ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 00:47:08
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:47:03.014978 2026] [security2:error] [pid 28294:tid 28294] [client 187.40.234.148:28966] ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.234.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 19:47:03.014978 2026] [security2:error] [pid 28294:tid 28294] [client 187.40.234.148:28966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tacanicsa.com"] [uri "/.env"] [unique_id "au0jh-rJT9AxVoB4dS36pAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-11-06 00:04:05
UTC ·
(15 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-05 23:45:06
UTC ·
(16 hours ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
