🇺🇸
TPI-Abuse
2026-07-17 09:59:07
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 05:59:02.678766 2026] [security2:error] [pid 921:tid 969] [client 209.87.164.204:54087] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "geekshop.com"] [uri "/.env"] [unique_id "aln85ryCJIq5EPVpFkL6BgAAAII"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 09:29:54
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 05:29:47.071144 2026] [security2:error] [pid 632815:tid 632815] [client 209.87.164.204:28287] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dianamead.com"] [uri "/.env"] [unique_id "aln2C_UuxU-02eDcx7GFOwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-07-17 09:24:06
(12 hours ago)
[Fri Jul 17 19:24:05.743295 2026] [security2:error] [pid 585070] [client 209.87.164.204:41543] [clie ...
show more
[Fri Jul 17 19:24:05.743295 2026] [security2:error] [pid 585070] [client 209.87.164.204:41543] [client 209.87.164.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dlcarterauthor.com"] [uri "/.env"] [unique_id "aln0tbLXGbf1fpQFru49_QAAAAY"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:47:18
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:47:14.609599 2026] [security2:error] [pid 26216:tid 26216] [client 209.87.164.204:30665] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adona.org"] [uri "/.env"] [unique_id "alnsEtoRC57RZjEDOSSv4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
DZBOT
2026-07-17 08:31:17
(13 hours ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:31:04
(13 hours ago)
(mod_security) mod_security (id:949110) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:949110) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:30:59.146638 2026] [security2:error] [pid 549297:tid 549297] [client 209.87.164.204:38305] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "euro-theatre.com"] [uri "/.env"] [unique_id "alnoQ1RxPlJXwEq0Neu8ZAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-07-17 08:14:13
(14 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 08:08:33
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:08:26.942197 2026] [security2:error] [pid 425672:tid 425672] [client 209.87.164.204:36303] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "afdfurniture.com"] [uri "/.env"] [unique_id "alni-uF76FimCWiwErHIPAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 07:35:06
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 03:35:01.439595 2026] [security2:error] [pid 1317:tid 1317] [client 209.87.164.204:61827] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "microdot.net"] [uri "/.env"] [unique_id "alnbJTNKBEGB_UEOFSchSAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 06:55:25
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 02:55:19.359133 2026] [security2:error] [pid 1688:tid 1688] [client 209.87.164.204:41219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fashionmenswear.com"] [uri "/.env"] [unique_id "alnR19CvRcbyQ8tXiM9ucgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Klaverstyn
2026-07-17 06:37:42
(15 hours ago)
Repeated 403 Forbidden responses
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 06:21:41
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 02:21:37.092801 2026] [security2:error] [pid 25905:tid 25905] [client 209.87.164.204:54433] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mascotrack.com"] [uri "/.env"] [unique_id "alnJ8YzWHDx2PqZRUrY-UAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-07-17 05:57:37
(16 hours ago)
IM360 WAF: Direct access to sensitive file or dotfile MV:/.env
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 05:56:25
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.87.164.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:56:18.580925 2026] [security2:error] [pid 476810:tid 476810] [client 209.87.164.204:38839] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brainwavecenters.com"] [uri "/.env"] [unique_id "alnEAu4k9v-PZ43jHYjo5gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-17 05:51:59
(16 hours ago)
209.87.164.204 - - [17/Jul/2026:13:51:58 +0800] "GET /.env HTTP/1.1" 301 231 "-" "Mozilla/5.0 (Macin ...
show more
209.87.164.204 - - [17/Jul/2026:13:51:58 +0800] "GET /.env HTTP/1.1" 301 231 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Bad Web Bot
Web App Attack