🇫🇷
mail.avx.gr
2026-08-05 20:51:46
(2 months ago)
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 209.87.164.198 - - [01/Aug/2026:20:48:39 +0300] " ...
show more
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 209.87.164.198 - - [01/Aug/2026:20:48:39 +0300] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
🇺🇸
infra-monitor
2026-08-01 19:00:04
(2 months ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan
🇺🇸
TPI-Abuse
2026-08-01 18:06:28
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 14:06:21.394618 2026] [security2:error] [pid 2315124:tid 2315124] [client 209.87.164.198:41945] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "compformation.com"] [uri "/.env"] [unique_id "am41nedq-Mplr81nCB3K6gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mail.avx.gr
2026-08-01 17:48:40
(2 months ago)
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 209.87.164.198 - - [01/Aug/2026:20:48:39 +0300] " ...
show more
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 209.87.164.198 - - [01/Aug/2026:20:48:39 +0300] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
🇬🇧
sleepingcat1714
2026-08-01 17:39:48
(2 months ago)
01-08-2026:17:39:48UTC [Web Server] Suspicious web request: path:/.env (1 request(s)).
Bad Web Bot
Web App Attack
2026-08-01 16:44:03
(2 months ago)
Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1
Hacking
Web App Attack
🇩🇪
gadix
2026-08-01 16:36:41
(2 months ago)
[01/Aug/2026:18:36:36.668147 +0200] am4glA6KoEaDlOLbORfsLAAAAJE 209.87.164.198 50818 127.0.0.1 7081
...
show more
[01/Aug/2026:18:36:36.668147 +0200] am4glA6KoEaDlOLbORfsLAAAAJE 209.87.164.198 50818 127.0.0.1 7081
[01/Aug/2026:18:36:37.835377 +0200] am4glR8Qla71qiXaBPUC_QAAAFM 209.87.164.198 50824 127.0.0.1 7081
[01/Aug/2026:18:36:40.534633 +0200] am4gmA6KoEaDlOLbORfsLQAAAJM 209.87.164.198 52474 127.0.0.1 7081
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:50:15
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:50:10.514486 2026] [security2:error] [pid 2018609:tid 2018609] [client 209.87.164.198:54593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "siedersoft.com.ar"] [uri "/.env"] [unique_id "am4Vsjq6Lwt4YF7yFosHvQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 14:29:59
(2 months ago)
Automatically blocked after 1 security event. Observed sensitive configuration-file probes. Source: ...
show more
Automatically blocked after 1 security event. Observed sensitive configuration-file probes. Source: Cloudflare security controls.
show less
Hacking
Web App Attack
🇵🇱
sefinek.net
2026-08-01 13:41:13
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
dtorrer
2026-08-01 13:20:22
(2 months ago)
General vulnerability scan.
Port Scan
🇩🇪
Ba-Yu
2026-08-01 13:02:37
(2 months ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 12:31:17
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 08:31:09.609162 2026] [security2:error] [pid 1628594:tid 1628594] [client 209.87.164.198:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "antitribu.com"] [uri "/.env"] [unique_id "am3nDbpzp2LkjEN_2z6IRAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 11:48:24
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 07:48:15.581380 2026] [security2:error] [pid 2393921:tid 2393921] [client 209.87.164.198:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "betiqos.com"] [uri "/.env"] [unique_id "am3c_0hhEMAQqYSrLMKQLwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 10:15:01
(2 months ago)
suspicious request in access.log
Web App Attack