🇺🇸
TPI-Abuse
2026-06-07 21:09:19
(12 minutes ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 17:09:15.333607 2026] [security2:error] [pid 22214:tid 22214] [client 206.232.40.209:33567] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robertmcatee.com"] [uri "/.env.swp"] [unique_id "aiXd-_0XI3N6dPH-XT7o5wAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-06-07 20:09:31
(1 hour ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 206.232.40.209 (IT/Italy ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 206.232.40.209 (IT/Italy/-)
show less
Port Scan
🇧🇷
Halux
2026-06-07 19:52:41
(1 hour ago)
206.232.40.209 Web Application Firewall multiple violations
Hacking
Web App Attack
🇷🇴
iulianh
2026-06-07 19:33:36
(1 hour ago)
80,443
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-07 19:30:32
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:30:26.569080 2026] [security2:error] [pid 26925:tid 26925] [client 206.232.40.209:35413] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "digifonics.com"] [uri "/.env.local.swo"] [unique_id "aiXG0t48TmriDXym4vtxLAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
DEV-DNS
2026-06-07 19:06:37
(2 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-06-07 18:55:11
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 14:55:07.510017 2026] [security2:error] [pid 8412:tid 8412] [client 206.232.40.209:37861] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alosi.us"] [uri "/.htaccess.swp"] [unique_id "aiW-i59V04_Tg49HP7uCTwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-06-07 18:23:41
(2 hours ago)
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based ...
show more
AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based) - ❌ Excessive 40X Errors (Decay-Based)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 17:40:44
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 13:40:40.333330 2026] [security2:error] [pid 10442:tid 10442] [client 206.232.40.209:37593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joebankx.com"] [uri "/.git/config"] [unique_id "aiWtGC-PEL8qqCJ-Adx_LAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
pixiekat
2026-06-07 17:09:09
(4 hours ago)
[Sun Jun 07 18:08:43.822393 2026] [authz_core:error] [pid 609059:tid 609148] [client 206.232.40.209: ...
show more
[Sun Jun 07 18:08:43.822393 2026] [authz_core:error] [pid 609059:tid 609148] [client 206.232.40.209:38685] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhosts/spacecadetgrrl-me/web/.env.swp
[Sun Jun 07 18:08:45.461908 2026] [authz_core:error] [pid 609059:tid 609146] [client 206.232.40.209:40861] AH01630: client denied by server configuration: proxy:http://100.79.113.37:8096/.vscode/sftp.json
[Sun Jun 07 18:08:46.052942 2026] [authz_core:error] [pid 609043:tid 609122] [client 206.232.40.209:33385] AH01630: client denied by server configuration: proxy:http://96.237.140.60:8096/.git/HEAD
[Sun Jun 07 18:09:06.278267 2026] [authz_core:error] [pid 609059:tid 609152] [client 206.232.40.209:40195] AH01630: client denied by server configuration: proxy:http://96.237.140.60:8096/.env.example.swp
[Sun Jun 07 18:09:09.138470 2026] [authz_core:error] [pid 609043:tid 609093] [client 206.232.40.209:45755] AH01630: client denied by server configuration: proxy:http://96.237.1
...
show less
Brute-Force
🇺🇸
infra-monitor
2026-06-07 16:00:06
(5 hours ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan
🇺🇸
TPI-Abuse
2026-06-07 15:51:46
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 11:51:38.208856 2026] [security2:error] [pid 1557:tid 1620] [client 206.232.40.209:41589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ja-parismacau.com"] [uri "/.env.dev"] [unique_id "aiWTioMSmSzfB1UmYCypZwAAAZQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 15:32:20
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 11:32:14.649243 2026] [security2:error] [pid 4293:tid 4293] [client 206.232.40.209:38895] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.realtyhubvideo.com"] [uri "/.env.local.swo"] [unique_id "aiWO_uv0F3lZC8eaM-qTHQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Smish
2026-06-07 15:07:03
(6 hours ago)
HONEYPOT HIT --> Fail2ban time=1780844821 log=2026-06-07T16:07:01+01:00 ip=206.232.40.209 host=as210 ...
show more
HONEYPOT HIT --> Fail2ban time=1780844821 log=2026-06-07T16:07:01+01:00 ip=206.232.40.209 host=as210667.net method=HEAD uri="/.git/config" status=404 ua="Mozilla/5.0 (compatible; WhiteWebSecurity/1.0; +https://whitewebsecurity.com; [email protected] )" ref="-" rid=e263392912e2e93347ce7d673187b9c6
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 15:04:49
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.40.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 11:04:46.409405 2026] [security2:error] [pid 5134:tid 5134] [client 206.232.40.209:46289] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tsiwny.org"] [uri "/.env.production.swp"] [unique_id "aiWIjl9VDN145ISBc1zHLwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack