2026-07-01 04:32:36
(2 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
Lino Project
2026-06-03 13:22:04
(3 months ago)
193.221.201.135 - - [03/Jun/2026:15:22:00 +0200] "GET /.env HTTP/2.0" 403 253 "-" "Mozilla/5.0 (Maci ...
show more
193.221.201.135 - - [03/Jun/2026:15:22:00 +0200] "GET /.env HTTP/2.0" 403 253 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
David Koswari
2026-06-02 06:05:00
(3 months ago)
REQ_BLOCKED_ACL
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇩🇪
4server
2026-06-01 21:16:48
(3 months ago)
[MonJun0123:16:42.8063292026][security2:error][pid3309866:tid3310002][client193.221.201.135:0]ModSec ...
show more
[MonJun0123:16:42.8063292026][security2:error][pid3309866:tid3310002][client193.221.201.135:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.distributori-automatici-sigarette-ticino.ch.136-243-54-122.cpanel.site\"][uri\"/wp-config.php.bak\"][unique_id\"ah32uhR-4pwj-B7tq6AquAAAARc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇸🇬
serverutama
2026-06-01 12:00:07
(3 months ago)
Nginx scanner: 193.221.201.135 - - [01/Jun/2026:18:12:44 +0700] "GET /.env HTTP/1.1" 444 0 "-" "Mozi ...
show more
Nginx scanner: 193.221.201.135 - - [01/Jun/2026:18:12:44 +0700] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15" "-" 193.221.201.135 - - [01/Jun/2026:18:12:44 +0700] "GET /.env.production.local HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0" "-"
show less
Web App Attack
Bad Web Bot
🇨🇿
ptlab
2026-06-01 10:45:10
(3 months ago)
Detected env_leak attack from WP-host.
Hacking
Web App Attack
2026-06-01 10:38:12
(3 months ago)
193.221.201.135 - - [01/Jun/2026:18:38:12 +0800] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 10:26:54
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 06:26:48.203237 2026] [security2:error] [pid 12184:tid 12184] [client 193.221.201.135:59276] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lukeschicago.com"] [uri "/.env"] [unique_id "ah1eaNtc543eqWrRAOW09QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-06-01 10:20:49
(3 months ago)
Web App Attack Exploid from 193.221.201.135
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-01 10:11:23
(3 months ago)
193.221.201.135 - - [01/Jun/2026:13:11:21 +0300] "GET /.env HTTP/1.1" 404 3351 "-" "Mozilla/5.0"
...
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 09:57:07
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 05:57:04.051767 2026] [security2:error] [pid 7095:tid 7106] [client 193.221.201.135:53242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "montanatribes.org"] [uri "/.env"] [unique_id "ah1XcH8we06muJz5p2Lz_wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 09:40:10
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 193.221.201.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 05:40:06.990687 2026] [security2:error] [pid 29350:tid 29350] [client 193.221.201.135:41240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tausiet.com"] [uri "/.env"] [unique_id "ah1TdkyvDuD7Wz5wZqHIfwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-01 09:34:26
(3 months ago)
325 requests with url.path *.env
Brute-Force
Bad Web Bot
🇧🇷
Halux
2026-06-01 09:33:48
(3 months ago)
193.221.201.135 Probing protected path or service
Web App Attack
🇳🇱
BlueWire Hosting
2026-06-01 09:33:07
(3 months ago)
Probing websites for vulnerabilities
Web App Attack