🇳🇱
homeshowdomain.nl
2026-10-22 22:03:37
(14 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-21.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-22 13:35:35
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 09:35:29.927210 2026] [security2:error] [pid 12657:tid 12657] [client 187.40.235.94:57578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ladymcollection.com"] [uri "/.env"] [unique_id "atoRIcEdTRENPRsXuE-zegAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-22 08:26:36
(1 day ago)
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 187.40.235.94 (US/United States/ ...
show more
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 187.40.235.94 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 07:09:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 03:09:52.133074 2026] [security2:error] [pid 6755:tid 6755] [client 187.40.235.94:44132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "krmartindale.com"] [uri "/.env"] [unique_id "atm2wEz0pFMOlbvuhBm5agAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-22 06:54:22
(1 day ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 04:46:43
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:46:39.324008 2026] [security2:error] [pid 22479:tid 22479] [client 187.40.235.94:11550] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nihlabs.org"] [uri "/.env"] [unique_id "atmVL12t-nxpXSdNgtJqgQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 03:24:06
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 23:24:01.887943 2026] [security2:error] [pid 30636:tid 30636] [client 187.40.235.94:11836] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kritaka.ai"] [uri "/.env"] [unique_id "atmB0ZzPkqfy20hrFcVllAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 03:05:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 23:05:21.375693 2026] [security2:error] [pid 21742:tid 21742] [client 187.40.235.94:8690] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kristywernerauthor.com"] [uri "/.env"] [unique_id "atl9cRPKBHRitmL2lj7n4QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 02:28:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:28:04.366233 2026] [security2:error] [pid 13244:tid 13244] [client 187.40.235.94:27872] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ladbc.club"] [uri "/.env"] [unique_id "atl0tGjLJA3mjDHep4qyNQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 01:57:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 21:57:14.771272 2026] [security2:error] [pid 5101:tid 5101] [client 187.40.235.94:56244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kristinmoore.com"] [uri "/.env"] [unique_id "atlteqC3IkA0K1lv1mySNgAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 23:37:28
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 19:37:23.852517 2026] [security2:error] [pid 31106:tid 31106] [client 187.40.235.94:32962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nightowlprinting.com"] [uri "/.env"] [unique_id "atlMs5CYnBu261VArdr-9QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 22:40:48
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 187.40.235.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 18:40:43.842232 2026] [security2:error] [pid 24928:tid 24928] [client 187.40.235.94:35664] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kristencorley.com"] [uri "/.env"] [unique_id "atk_a8G1y2m3QVVuSD3CBgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-21 22:32:05
(1 day ago)
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 187.40.235.94 - - [22/Oct/2026:00:32:02 +0200] "GET /.env HTTP/1.1" 301 608 "-" "python-requests/2.32.4"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-21 22:04:44
(1 day ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 187 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 187.40.235.94 - - \[22/Oct/2026:00:04:35 +0200\] "GET /.env HTTP/1.1" 301 487 "-" "python-requests/2.32.4"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-21 22:00:52
(1 day ago)
Auto-ban: >3000 req/min op 2026-10-21
Web App Attack
SSH
Hacking