🇺🇸
TPI-Abuse
2026-09-20 08:24:24
(8 hours ago)
(mod_security) mod_security (id:949110) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:949110) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 04:24:12.052667 2026] [security2:error] [pid 28242:tid 28242] [client 213.254.175.190:50205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.64.150.240"] [uri "/storage/.env"] [unique_id "aq-YLPUas3tTXoLXJ4wSxAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
id2i
2026-09-19 10:55:20
(1 day ago)
2026-09-19T12:55:20.433917+02:00 coraza-spoa[262622]: [client "213.254.175.190"] Coraza: Access deni ...
show more
2026-09-19T12:55:20.433917+02:00 coraza-spoa[262622]: [client "213.254.175.190"] Coraza: Access denied (phase 2). Inbound Anomaly Score Exceeded (Total Score: 8)
show less
Hacking
Web App Attack
2026-09-18 15:24:22
(2 days ago)
fail2ban jail apache-secrets-probe: 213.254.175.190 - - [18/Sep/2026:08:24:18 -0700] "GET /library/. ...
show more
fail2ban jail apache-secrets-probe: 213.254.175.190 - - [18/Sep/2026:08:24:18 -0700] "GET /library/.env HTTP/1.1" 403 497 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 11:32:41
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 07:32:25.971480 2026] [security2:error] [pid 31209:tid 31215] [client 213.254.175.190:49751] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.80"] [uri "/base/.env"] [unique_id "aq0hScGahgHRcNfC6TAZpgAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 08:47:12
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 04:46:49.331934 2026] [security2:error] [pid 804:tid 804] [client 213.254.175.190:42101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.215"] [uri "/cgi-bin/.env"] [unique_id "aqz6eUkssHoK9oI74GBtVAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 07:27:50
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 03:27:21.070927 2026] [security2:error] [pid 30982:tid 30982] [client 213.254.175.190:41337] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.242"] [uri "/src/.env"] [unique_id "aqzn2fulsuIqRg91aVkLZgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
gadix
2026-09-18 02:42:48
(2 days ago)
[18/Sep/2026:04:42:40.737236 +0200] aqylIM1ZrzVjw__dU97E1AAAAAA 213.254.175.190 52102 127.0.0.1 7080 ...
show more
[18/Sep/2026:04:42:40.737236 +0200] aqylIM1ZrzVjw__dU97E1AAAAAA 213.254.175.190 52102 127.0.0.1 7080
[18/Sep/2026:04:42:42.358750 +0200] aqylIvxj-52HfYiYorJXwgAAAAY 213.254.175.190 48498 127.0.0.1 7080
[18/Sep/2026:04:42:47.614392 +0200] aqylJ8K2LqLGJ9-KLi5TXAAAAAE 213.254.175.190 48590 127.0.0.1 7080
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 00:43:39
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 20:43:34.501538 2026] [security2:error] [pid 31405:tid 31405] [client 213.254.175.190:35109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.244"] [uri "/new/.env"] [unique_id "aqyJNjC-cOVlTJJCphr0MwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 15:43:14
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 11:43:06.440355 2026] [security2:error] [pid 14255:tid 14255] [client 213.254.175.190:24839] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.109"] [uri "/conf/.env"] [unique_id "aqwKipuVJsp28d9hLhcF0gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 13:16:56
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 09:16:44.200536 2026] [security2:error] [pid 17754:tid 17754] [client 213.254.175.190:25625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.168"] [uri "/vendor/.env"] [unique_id "aqvoPNMpXbo351YT46y9MQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 12:10:50
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:10:46.450037 2026] [security2:error] [pid 334874:tid 334874] [client 213.254.175.190:40791] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.181"] [uri "/wp-admin/.env"] [unique_id "aqvYxrwyKiT2Zsk67Z_T8AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 10:59:13
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 06:58:59.972738 2026] [security2:error] [pid 5151:tid 5151] [client 213.254.175.190:57711] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.73"] [uri "/new/.env"] [unique_id "aqvH83sKWVQPXl4dWIh9AAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 09:37:18
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:36:52.340882 2026] [security2:error] [pid 20633:tid 20633] [client 213.254.175.190:42111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.195"] [uri "/app/.env"] [unique_id "aqu0tG8dAFuSHun6p7zGFQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 07:28:28
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 03:28:07.681633 2026] [security2:error] [pid 29365:tid 29365] [client 213.254.175.190:21149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.118"] [uri "/library/.env"] [unique_id "aquWhyZC3VkWjOLaf2uKvAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 06:35:14
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 02:35:08.120080 2026] [security2:error] [pid 2186:tid 2186] [client 213.254.175.190:30465] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.100"] [uri "/.env"] [unique_id "aquKHEqOqHTnMSD39J03zgAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack