🇺🇸
TPI-Abuse
2026-10-26 03:58:25
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 23:58:22.277651 2026] [security2:error] [pid 14826:tid 14861] [client 196.127.98.165:58200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clmtic.es"] [uri "/.env"] [unique_id "at7P3uwVg0OmWHr4OKh1tgAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-10-26 03:55:01
(1 day ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 02:08:20
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 22:08:12.557474 2026] [security2:error] [pid 1427:tid 1427] [client 196.127.98.165:50548] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cederberg.es"] [uri "/.env"] [unique_id "at62DA-3FtHs1KFRnMKvcwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-26 01:25:32
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-26 01:10:12
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:10:07.087977 2026] [security2:error] [pid 19002:tid 19002] [client 196.127.98.165:52203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blc2.co"] [uri "/.env"] [unique_id "at6ob2ULR8_f-SNgHAdmOAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
KTSTechnology
2026-10-25 23:55:51
(1 day ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 20:59:34
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 16:59:28.229657 2026] [security2:error] [pid 29120:tid 29120] [client 196.127.98.165:59834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aycart.es"] [uri "/.env"] [unique_id "at5tsNKxbLTi-ah2zUp5ewAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 20:30:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 196.127.98.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 16:30:10.856722 2026] [security2:error] [pid 7277:tid 7277] [client 196.127.98.165:52688] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "auracb.es"] [uri "/.env"] [unique_id "at5m0ikBgF8oMmnP0hy8aAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-10-25 19:34:10
(1 day ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇪🇸
bohl-aiG5aef
2026-10-25 18:59:41
(1 day ago)
Suricata Alert [SID:2031502] ET INFO Request to Hidden Environment File - Inbound
Hacking
2026-10-25 01:05:06
(2 days ago)
Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=12
Hacking
🇫🇷
masterguru
2026-10-24 23:25:29
(2 days ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack
🇫🇷
j-tap
2026-10-24 22:43:42
(2 days ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇧🇷
vfAcceloReporter
2026-10-24 22:05:24
(2 days ago)
196.127.98.165 - - [24/Oct/2026:19:05:23 -0300] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macin ...
show more
196.127.98.165 - - [24/Oct/2026:19:05:23 -0300] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
...
show less
Brute-Force
Web App Attack
Exploited Host
2026-10-24 21:35:22
(2 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host