🇳🇱
jjnxpct
2025-11-14 04:46:14
UTC ·
(11 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /api/.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /api/.env]
Hacking
Web App Attack
🇧🇪
voormedia
2025-11-14 01:18:37
UTC ·
(11 months ago)
Accessed trap at '/phpinfo.php'
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 23:41:23
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 18:41:17.097032 2025] [security2:error] [pid 23383:tid 23383] [client 196.89.173.155:53784] ...
show more
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 18:41:17.097032 2025] [security2:error] [pid 23383:tid 23383] [client 196.89.173.155:53784] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "giveorcas.org"] [uri "/.env"] [unique_id "aRZsnbV8bwK0U_rboLHrKQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Apache
2025-11-13 23:35:02
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (MA/Morocco/-): 5 in the last 300 secs
Brute-Force
Web App Attack
🇺🇸
EricTheRedFL
2025-11-13 23:20:25
UTC ·
(11 months ago)
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:07 -0500] "GET / HTTP/1.1" 301 529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:10 -0500] "GET / ...
show more
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:07 -0500] "GET / HTTP/1.1" 301 529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:10 -0500] "GET /phpinfo HTTP/1.1" 301 543 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:15 -0500] "GET /_profiler/phpinfo HTTP/1.1" 301 563 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:19 -0500] "GET /info HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
web.ab-data.us:80 196.89.173.155 - - [13/Nov/2025:18:20:22 -0500] "GET /phpinfo.php HTTP/1.1" 301 551 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 23:02:26
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 18:02:21.156886 2025] [security2:error] [pid 29390:tid 29390] [client 196.89.173.155:51180] ...
show more
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 18:02:21.156886 2025] [security2:error] [pid 29390:tid 29390] [client 196.89.173.155:51180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ssion.com"] [uri "/.env"] [unique_id "aRZjfdrP0ScJtL6YeKiVQQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
INTEQ
2025-11-13 21:52:40
UTC ·
(11 months ago)
Web attack from 196.89.173.155
Web App Attack
🇵🇱
strefapi_com
2025-11-13 20:48:55
UTC ·
(11 months ago)
Brute-force, web
...
Hacking
Brute-Force
Web App Attack
Anonymous
2025-11-13 20:44:34
UTC ·
(11 months ago)
Automated report (2025-11-14T04:44:34+08:00). Caught probing for env file.
Hacking
Web App Attack
Anonymous
2025-11-13 20:44:25
UTC ·
(11 months ago)
Automated report (2025-11-14T04:44:25+08:00). Hack attempt detected.
Hacking
🇺🇸
TPI-Abuse
2025-11-13 20:35:14
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 15:35:11.099395 2025] [security2:error] [pid 432609:tid 432625] [client 196.89.173.155:5539 ...
show more
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 15:35:11.099395 2025] [security2:error] [pid 432609:tid 432625] [client 196.89.173.155:55392] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gsji.org"] [uri "/.env"] [unique_id "aRZA_4aXAyExOcrWkk1FmQAAAUI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
entangled_mongoose
2025-11-13 20:28:14
UTC ·
(11 months ago)
Probed /info.php.
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 20:19:09
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 15:19:03.830493 2025] [security2:error] [pid 11207:tid 11207] [client 196.89.173.155:50235] ...
show more
(mod_security) mod_security (id:210492) triggered by 196.89.173.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 15:19:03.830493 2025] [security2:error] [pid 11207:tid 11207] [client 196.89.173.155:50235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vitess.com"] [uri "/.env"] [unique_id "aRY9N6giqh62Qmu-dczKLQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2025-11-13 19:35:32
UTC ·
(11 months ago)
(mod_security) mod_security (id:949110) triggered by 196.89.173.155 (MA/Morocco/-): N in the last X secs
Web App Attack
Anonymous
2025-11-13 18:58:33
UTC ·
(11 months ago)
Bot / scanning and/or hacking attempts: GET /_profiler/phpinfo HTTP/1.1, GET /info.php HTTP/1.1, GET /phpinfo.php HTTP/1.1, GET /admin/.env HTTP/1.1, GET /info HTTP/1.1, GET /app/.env HTTP/1.1, GET /.env HTTP/1.1
Hacking
Web App Attack