|
🇧🇷
ICS Labs
|
|
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-20 UTC.
|
Brute-Force
|
|
Anonymous
|
|
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
|
Exploited Host
|
|
Anonymous
|
|
Probing for exposed sensitive files.
|
Hacking
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 21:43:43.291345 2026] [security2:error] [pid 17393:tid 17416] [client 196.117.4.102:58117] M ...
show more
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 21:43:43.291345 2026] [security2:error] [pid 17393:tid 17416] [client 196.117.4.102:58117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clmtic.es"] [uri "/.env"] [unique_id "atbHT0vTimqNQQlb4nm86AAAANI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
masterguru
|
|
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-197)
|
Hacking
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 21:05:52.502288 2026] [security2:error] [pid 20666:tid 20666] [client 196.117.4.102:58255] M ...
show more
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 21:05:52.502288 2026] [security2:error] [pid 20666:tid 20666] [client 196.117.4.102:58255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blc2.co"] [uri "/.env"] [unique_id "ata-cJnARUBXFafsTGQL1QAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇸🇪
vaia.cloud
|
|
crowdsecurity/http-sensitive-files
|
Brute-Force
Web App Attack
|
|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
🇩🇪
macrob
|
|
2026/10/19 21:40:59 [error] 2324149#2324149: *16161968 access forbidden by rule, client: 196.117.4.102, server: binixo.co, request: "GET /.env HTTP/1.1", host: "binixo.co"
2026/10/19 21:41:00 [error] 2324149#2324149: *16161982 access forbidden by rul ...
show more
2026/10/19 21:40:59 [error] 2324149#2324149: *16161968 access forbidden by rule, client: 196.117.4.102, server: binixo.co, request: "GET /.env HTTP/1.1", host: "binixo.co"
2026/10/19 21:41:00 [error] 2324149#2324149: *16161982 access forbidden by rule, client: 196.117.4.102, server: binixo.co, request: "GET /.env.save HTTP/1.1", host: "binixo.co"
2026/10/19 21:41:00 [error] 2324149#2324149: *16161990 access forbidden by rule, client: 196.117.4.102, server: binixo.co, request: "GET /.env.php HTTP/1.1", host: "binixo.co"
...
show less
|
Web App Attack
|
|
🇧🇷
Halux
|
|
196.117.4.102 Probing protected path or service
|
Web App Attack
|
|
🇫🇷
masterguru
|
|
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
|
Hacking
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 14:07:08.101179 2026] [security2:error] [pid 11466:tid 11466] [client 196.117.4.102:50049] M ...
show more
(mod_security) mod_security (id:210492) triggered by 196.117.4.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 14:07:08.101179 2026] [security2:error] [pid 11466:tid 11466] [client 196.117.4.102:50049] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cederberg.es"] [uri "/.env"] [unique_id "atZcTL3W5zqi6AkyOKAQkQAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇮
KTSTechnology
|
|
Web vulnerability scanning detected by our ISP firewall
|
Web App Attack
|
|
🇬🇧
consul.to
|
|
Web attack/malicious scanning detected
|
Web App Attack
|
|
Anonymous
|
|
suspicious request in access.log
|
Web App Attack
|
