🇳🇱
GabrielJST
2026-10-18 17:13:30
(19 minutes ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 187.40.235.167 (US/U ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 187.40.235.167 (US/United States/-)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-18 14:25:14
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:25:06.852968 2026] [security2:error] [pid 5004:tid 5004] [client 187.40.235.167:25592] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bigheartskitchen.com"] [uri "/.env"] [unique_id "atTWwo9MEqQiKHjrAKrtjwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:58:54
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:58:46.595806 2026] [security2:error] [pid 6818:tid 6818] [client 187.40.235.167:38800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blessedhavenfarm.com"] [uri "/.env"] [unique_id "atTQlje6EcAFvrTG--qaSQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-10-18 05:11:42
(12 hours ago)
Scanning for exploits - /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:52:16
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:52:09.753029 2026] [security2:error] [pid 13630:tid 13630] [client 187.40.235.167:9820] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "directnic.games"] [uri "/.env"] [unique_id "atRCaSwLKN-KKqbstQFVPQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
YF
2026-10-18 01:30:30
(16 hours ago)
Environment file probe
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:17:30
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:17:23.361192 2026] [security2:error] [pid 22205:tid 22205] [client 187.40.235.167:9492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "directcch.com"] [uri "/.env"] [unique_id "atQCA5B7CqG7acwYmESeOQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-17 21:59:21
(19 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-16.
show less
Web App Attack
SSH
Hacking
2026-10-17 21:49:13
(19 hours ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 10:32:08
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 06:32:05.995444 2026] [security2:error] [pid 17371:tid 17371] [client 187.40.235.167:23916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "baumannarchitecture.com"] [uri "/.env"] [unique_id "atNOpZaGCikxGN52RBsaqAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 08:03:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 04:03:06.465334 2026] [security2:error] [pid 3873:tid 3873] [client 187.40.235.167:5718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "baughman.org"] [uri "/.env"] [unique_id "atMrujX7p-6cY-8xroTiPQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 07:18:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 03:18:48.577725 2026] [security2:error] [pid 1680:tid 1680] [client 187.40.235.167:40908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "avmarep.com"] [uri "/.env"] [unique_id "atMhWHcPJniG1n1SGFHJvgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 05:59:07
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 01:58:59.247516 2026] [security2:error] [pid 18682:tid 18682] [client 187.40.235.167:47094] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atticlodgeoutdoorlearningcenter.com"] [uri "/.env"] [unique_id "atMOo1jEM7iQzl3rW96pzQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-17 03:38:10
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 02:28:32
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 22:28:26.566443 2026] [security2:error] [pid 11301:tid 11301] [client 187.40.235.167:17610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yerevanpress.am"] [uri "/.env"] [unique_id "atLdSrdDjkODjZEJJONaXQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
