🇺🇸
TPI-Abuse
2026-06-05 03:22:33
(56 minutes ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 23:22:26.938616 2026] [security2:error] [pid 30412:tid 30412] [client 208.84.102.25:52946] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.fixitsmart.com"] [uri "/.env.production.copy"] [unique_id "aiJA8kb7EgvjCNfRoGXbzwAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 02:55:22
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 22:55:14.798039 2026] [security2:error] [pid 25875:tid 25875] [client 208.84.102.25:37536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.ismycorporationsafe.com"] [uri "/.env.production.copy"] [unique_id "aiI6kkzfcq7ZLyJhy-EXVQAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
✨
2026-06-05 02:32:07
(1 hour ago)
Domain : kenninghomes.com
Rule : hack
2026-06-05 02:30:19 ***hidden-privacy*** GET /.env.bak - 443 - ...
show more
Domain : kenninghomes.com
Rule : hack
2026-06-05 02:30:19 ***hidden-privacy*** GET /.env.bak - 443 - 208.84.102.25 HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 - kenninghomes.com 404 0 0 13049 304 938 - -
show less
Hacking
SQL Injection
Brute-Force
2026-06-05 02:20:18
(1 hour ago)
(caddyscan) Scanner path probe from 208.84.102.25 (US/United States/-): 5 in the last 3600 secs; Por ...
show more
(caddyscan) Scanner path probe from 208.84.102.25 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 208.84.102.25 - - [05/Jun/2026:02:20:16 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 208.84.102.25 - - [05/Jun/2026:02:20:17 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 208.84.102.25 - - [05/Jun/2026:02:20:17 +0000] "GET /api/.env HTTP/1.1"
[REDACTED] 200 2627 208.84.102.25 - - [05/Jun/2026:02:20:17 +0000] "GET /laravel/.env HTTP/1.1"
[REDACTED] 200 2627 208.84.102.25 - - [05/Jun/2026:02:20:17 +0000] "GET /.env.production HTTP/1.1"
show less
Port Scan
🇫🇷
masterguru
2026-06-05 01:56:08
(2 hours ago)
Restricted File Access Attempt. Matched phrase ".yarnrc" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 01:50:58
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 21:50:54.481405 2026] [security2:error] [pid 32519:tid 32519] [client 208.84.102.25:8886] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.asiancommoditiescorporation.com"] [uri "/.env.development"] [unique_id "aiIrfkc7YZmu9hd1HYny9AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-06-05 01:36:46
(2 hours ago)
Attempted access to sensitive endpoint (/config/service-account.json) detected. Automated scan or un ...
show more
Attempted access to sensitive endpoint (/config/service-account.json) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 01:19:45
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 21:19:39.089701 2026] [security2:error] [pid 32715:tid 32715] [client 208.84.102.25:13162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stricklinphotography.com"] [uri "/.env.local.bak"] [unique_id "aiIkKxhgL11p3_B7v0tEOgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-06-05 00:44:02
(3 hours ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇳🇱
ReyhZhao
2026-06-04 23:15:56
(5 hours ago)
Bunkerweb ModSecurity alert: Access denied (403) due to an inbound anomaly score exceeding the allow ...
show more
Bunkerweb ModSecurity alert: Access denied (403) due to an inbound anomaly score exceeding the allowed threshold, triggering the OWASP Core Rule Set blocking evaluation.
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-04 22:31:57
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 18:31:52.372624 2026] [security2:error] [pid 26046:tid 26046] [client 208.84.102.25:16936] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.scadainthecloud.com"] [uri "/.env.production.copy"] [unique_id "aiH82JC--S5Pzd1htHZ3jQAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 22:11:04
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 18:11:00.752488 2026] [security2:error] [pid 31560:tid 31560] [client 208.84.102.25:39640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.jkg1.com"] [uri "/.env.local.backup"] [unique_id "aiH39NjU7Q7oeizdKpf0BgAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-06-04 22:05:13
(6 hours ago)
Scanning/Probing (24)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 21:49:34
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 208.84.102.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 17:49:28.454442 2026] [security2:error] [pid 17593:tid 17593] [client 208.84.102.25:58580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.technoware-lb.com"] [uri "/.env.production.copy"] [unique_id "aiHy6DxuCwsOuu6LEE-8gQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Skyrider
2026-06-04 21:46:17
(6 hours ago)
crowdsecurity/http-sensitive-files
Hacking