🇺🇸
TPI-Abuse
2026-10-16 11:57:28
(16 minutes ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 07:57:19.671520 2026] [security2:error] [pid 29182:tid 29182] [client 201.5.140.195:54523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eb3d.net"] [uri "/.env"] [unique_id "atIRH0-8WLrsUnhKv6zVAAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-16 08:02:52
(4 hours ago)
csagent: score 20.1: secrets grab x2, 404 noise floor x1; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 07:02:20
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 03:02:12.233739 2026] [security2:error] [pid 1382:tid 1382] [client 201.5.140.195:60007] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eeeckythump.net"] [uri "/.env"] [unique_id "atHL9Mqc_u0n6DnOHIzc1QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
boxed-it
2026-10-16 04:44:21
(7 hours ago)
GET /.env (Tarpitted for 21h8m6s, wasted 4.35MB)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 20:19:15
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 16:19:10.888212 2026] [security2:error] [pid 5848:tid 5848] [client 201.5.140.195:57051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cephali.net"] [uri "/.env"] [unique_id "atE1PnFf8X6etW6UzxoH8AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 19:25:27
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 15:25:19.582256 2026] [security2:error] [pid 11431:tid 11748] [client 201.5.140.195:62108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asetiadi.net"] [uri "/.env"] [unique_id "atEon_9NY0f7lCN-iZdSVwAAAIE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-15 19:03:35
(17 hours ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 201.5.140.195 - - [15/Oct/2026:21:03:31 +0200] "GET /.env HTTP/1.1" 404 7903 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇨🇱
Fernando Soto
2026-10-15 18:45:02
(17 hours ago)
WAF propio vps1 (CL): sensx2 score 8 en 1h. sondeo rutas sensibles.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 18:34:17
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 14:34:12.395293 2026] [security2:error] [pid 17440:tid 17440] [client 201.5.140.195:49576] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crescentcitycafe.net"] [uri "/.env"] [unique_id "atEcpCsyppgQYjdEg6eEdQAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
csnavarro2020
2026-10-15 18:30:22
(17 hours ago)
Automated scan for known vulnerable/nonexistent path: /.env
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-15 17:36:04
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 13:35:56.892552 2026] [security2:error] [pid 28550:tid 28550] [client 201.5.140.195:57583] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daydar.net"] [uri "/.env"] [unique_id "atEO_BAQ_Sk0Eq8wbpk98AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-15 13:44:26
(22 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-15 UTC.
Brute-Force
🇳🇱
ParaBug
2026-10-15 12:31:09
(23 hours ago)
201.5.140.195 - - [15/Oct/2026:14:31:08 +0200] "GET /.env HTTP/1.1" 301 533 "-" "Mozilla/5.0 (X11; L ...
show more
201.5.140.195 - - [15/Oct/2026:14:31:08 +0200] "GET /.env HTTP/1.1" 301 533 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Phishing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:16:33
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:16:27.940846 2026] [security2:error] [pid 25901:tid 25901] [client 201.5.140.195:62916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bandsolution.net"] [uri "/.env"] [unique_id "atDEG9zrBuMKYF5AI9D0lQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:18:59
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 201.5.140.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:18:53.812129 2026] [security2:error] [pid 28417:tid 28417] [client 201.5.140.195:63775] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidsonmanagement.net"] [uri "/.env"] [unique_id "atCojdgPDKs4ahWmZAQppwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
