🇺🇸
TPI-Abuse
2026-06-25 12:55:36
(47 minutes ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 08:55:32.344696 2026] [security2:error] [pid 15840:tid 15840] [client 208.84.101.146:11970] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.reachpoint.com"] [uri "/.env.production.copy"] [unique_id "aj0lRJYprWnleXNJWiswcQAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-06-25 12:07:17
(1 hour ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
Lee Daniel
2026-06-25 11:36:33
(2 hours ago)
208.84.101.146 - - [25/Jun/2026:07:36:32 -0400] "GET /.env HTTP/1.1" 403 4840 "-" "Mozilla/5.0 (Wind ...
show more
208.84.101.146 - - [25/Jun/2026:07:36:32 -0400] "GET /.env HTTP/1.1" 403 4840 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
...
show less
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-06-25 09:50:04
(3 hours ago)
Web App Attack
🇩🇪
NewGastroline
2026-06-25 09:45:39
(3 hours ago)
Malicious request blocked by CrowdSec on gastro-prod1.boreus.de
Bad Web Bot
Web App Attack
🇩🇪
kivitendo.de
2026-06-25 09:32:41
(4 hours ago)
[Thu Jun 25 11:32:40.678624 2026] [access_compat:error] [pid 140994:tid 141046] [client 208.84.101.1 ...
show more
[Thu Jun 25 11:32:40.678624 2026] [access_compat:error] [pid 140994:tid 141046] [client 208.84.101.146:17990] AH01797: client denied by server configuration: /var/www/kivitendo-erp/config/gcp-credentials.json
[Thu Jun 25 11:32:40.691677 2026] [access_compat:error] [pid 140993:tid 141013] [client 208.84.101.146:18162] AH01797: client denied by server configuration: /var/www/kivitendo-erp/config/default.json
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 09:27:56
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 05:27:51.113913 2026] [security2:error] [pid 4725:tid 4725] [client 208.84.101.146:29908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.masterpiecemorgans.com"] [uri "/.env.production.copy"] [unique_id "ajz0l-xeTS5WOnn39FEN7wAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Petros Stefanakis
2026-06-25 09:11:22
(4 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 208.84.101.146 (US/United States/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-06-25 09:08:24
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 05:08:17.395313 2026] [security2:error] [pid 19313:tid 19313] [client 208.84.101.146:11176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sunshine-trust.com"] [uri "/.env.swp"] [unique_id "ajzwAQXb-lBOg0od8LAUxQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 08:43:08
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 04:43:04.887198 2026] [security2:error] [pid 20058:tid 20121] [client 208.84.101.146:18544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.castaspell.com"] [uri "/.git/refs/heads/main"] [unique_id "ajzqGA1LWi7QiUKz7mml3wAAAMA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Dominik Lysiak
2026-06-25 08:36:09
(5 hours ago)
208.84.101.146 - - [25/Jun/2026:10:36:06 +0200] "GET /wp-content/debug.log HTTP/1.1" 401 574 "-" "Mo ...
show more
208.84.101.146 - - [25/Jun/2026:10:36:06 +0200] "GET /wp-content/debug.log HTTP/1.1" 401 574 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
208.84.101.146 - - [25/Jun/2026:10:36:08 +0200] "GET /.env HTTP/1.1" 401 574 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0"
208.84.101.146 - - [25/Jun/2026:10:36:08 +0200] "GET /.env.production HTTP/1.1" 401 172 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
...
show less
Web App Attack
🇺🇸
kosada.com
2026-06-25 08:05:25
(5 hours ago)
Web vulnerability probing: /.env.development
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 08:00:41
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.101.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 04:00:36.123951 2026] [security2:error] [pid 10778:tid 10778] [client 208.84.101.146:20294] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.jcsforwarding.com"] [uri "/.env.production.copy"] [unique_id "ajzgJNFOkXxVfho_H4fs8AAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-06-25 07:53:43
(5 hours ago)
Attempted access to sensitive endpoint (/config/firebase_credentials.json) detected. Automated scan ...
show more
Attempted access to sensitive endpoint (/config/firebase_credentials.json) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇺🇸
jsjdmediallc
2026-06-25 07:37:27
(6 hours ago)
Auto-blocked: score 379 (threshold 10). Hits: 95. Tier: HIGH. Flags: git-exposure, error-scan, env-f ...
show more
Auto-blocked: score 379 (threshold 10). Hits: 95. Tier: HIGH. Flags: git-exposure, error-scan, env-file, backup-file, git-config, credentials, secret-file, wp-debug, log-file, aws-creds, conf-file. Paths: /.git/FETCH_HEAD, /.env.local.bak, /.env.swp, /.env.copy, /.env.local.old
show less
Bad Web Bot
Web App Attack