🇺🇸
LSPCCU
2026-06-15 21:40:12
(10 hours ago)
TSEC Honeypot Network report. Threat score: 68/100. Categories: Brute-Force, SSH. Honeypot: ssh-teln ...
show more
TSEC Honeypot Network report. Threat score: 68/100. Categories: Brute-Force, SSH. Honeypot: ssh-telnet, cowrie. Context: 209.
show less
Brute-Force
SSH
🇫🇮
inlink.ltd
2026-06-12 14:36:47
(3 days ago)
Known malicious PHP file or CMS probe
Web App Attack
🇩🇪
4server
2026-04-21 15:40:49
(1 month ago)
[TueApr2117:40:42.9410922026][security2:error][pid3025243:tid3025325][client209.50.171.208:0]ModSecu ...
show more
[TueApr2117:40:42.9410922026][security2:error][pid3025243:tid3025325][client209.50.171.208:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"avcolor.ch\"][uri\"/mysql.sql\"][unique_id\"aeeaemR1Z2zCLsvvYp9rYAAAAEo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-19 02:12:18
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 21:12:10.016953 2026] [security2:error] [pid 15760:tid 15760] [client 209.50.171.208:49623] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathyquan.com"] [uri "/.env.staging"] [unique_id "aZZxentdxdVlXnaDWFlGfAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
poundawebsiteltd
2026-02-19 02:10:32
(3 months ago)
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:80 209.50.171.208 - - [19/Feb/2026:0 ...
show more
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:80 209.50.171.208 - - [19/Feb/2026:02:10:29 +0000] GET /app/.git/config HTTP/1.1 403 214 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
show less
Web App Attack
🇺🇸
myagent.site
2026-02-19 01:45:54
(3 months ago)
Blocking for trying to access an exploit file: /.env.save
Hacking
🇺🇸
TPI-Abuse
2026-02-19 01:45:54
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 20:45:47.704327 2026] [security2:error] [pid 7404:tid 7404] [client 209.50.171.208:25347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karendraughon.com"] [uri "/admin/.env"] [unique_id "aZZrS4AnQxo2G-Sl2iCjLgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 22:44:21
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 17:44:17.370891 2026] [security2:error] [pid 26047:tid 26047] [client 209.50.171.208:27325] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "valarien.com"] [uri "/app/.env"] [unique_id "aZZAwZRlVkbTdKi60zCLgwAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 18:31:49
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 13:31:42.649496 2026] [security2:error] [pid 24170:tid 24170] [client 209.50.171.208:48391] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thewarmachineguns.com"] [uri "/admin/.env"] [unique_id "aZYFjroIzINNhGEz7brjUQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-02-18 16:06:01
(3 months ago)
Scanning/Probing (23)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 13:06:49
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 08:06:42.797077 2026] [security2:error] [pid 24031:tid 24031] [client 209.50.171.208:31883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whitecranemanagement.com"] [uri "/config/.env"] [unique_id "aZW5YsVS8FQdmvKjUjovVQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 11:46:12
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 06:46:04.376318 2026] [security2:error] [pid 31009:tid 31009] [client 209.50.171.208:43839] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "waltersnet.com"] [uri "/admin/.env"] [unique_id "aZWmfEi25qk2LNnKf-4kHgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
FaB Property Group
2026-02-10 11:45:29
(4 months ago)
Requested file: developer/.git/config
Web App Attack
🇺🇸
jcbriar
2026-02-10 05:17:49
(4 months ago)
Searching for vulnerable scripts
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 23:01:08
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.171.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 18:01:03.602877 2026] [security2:error] [pid 29744:tid 29744] [client 209.50.171.208:64647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "howtogetcoolstuffforfree.com"] [uri "/dev/.git/config"] [unique_id "aYpnL5x0YcoJuhnenIAkTQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack