🇺🇸
TPI-Abuse
2026-09-19 19:45:07
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 15:44:47.457882 2026] [security2:error] [pid 32272:tid 32272] [client 213.254.175.242:26151] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.57"] [uri "/blog/.env"] [unique_id "aq7mL6BJZFXHCgLrKYCkxQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
id2i
2026-09-19 10:55:24
(11 hours ago)
2026-09-19T12:55:23.850401+02:00 coraza-spoa[262622]: [client "213.254.175.242"] Coraza: Access deni ...
show more
2026-09-19T12:55:23.850401+02:00 coraza-spoa[262622]: [client "213.254.175.242"] Coraza: Access denied (phase 2). Inbound Anomaly Score Exceeded (Total Score: 8)
show less
Hacking
Web App Attack
2026-09-18 15:24:24
(1 day ago)
fail2ban jail apache-secrets-probe: 213.254.175.242 - - [18/Sep/2026:08:24:19 -0700] "GET /old/.env ...
show more
fail2ban jail apache-secrets-probe: 213.254.175.242 - - [18/Sep/2026:08:24:19 -0700] "GET /old/.env HTTP/1.1" 403 497 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 15:19:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 11:19:36.022443 2026] [security2:error] [pid 18944:tid 18944] [client 213.254.175.242:60061] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.6"] [uri "/new/.env"] [unique_id "aq1WiIvdll14pKGfjMVCBAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-09-18 13:44:51
(1 day ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 11:32:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 07:32:24.416812 2026] [security2:error] [pid 1124:tid 1135] [client 213.254.175.242:32569] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.80"] [uri "/audio/.env"] [unique_id "aq0hSDHi_ey7GSglmDDynQAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 08:47:04
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 04:46:50.871653 2026] [security2:error] [pid 9763:tid 9763] [client 213.254.175.242:33719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.215"] [uri "/core/.env"] [unique_id "aqz6erDYmUceR7wVij9BwgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 04:09:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 00:09:49.975409 2026] [security2:error] [pid 30427:tid 30442] [client 213.254.175.242:26581] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.125"] [uri "/conf/.env"] [unique_id "aqy5jYN_wgq2s7rbMJaP6QAAAEw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 01:53:33
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:53:24.434923 2026] [security2:error] [pid 27543:tid 27543] [client 213.254.175.242:61147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.58"] [uri "/.env"] [unique_id "aqyZlOilLbm2BVYHMWIKgwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ingroscart.it
2026-09-17 22:09:07
(2 days ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted])
Port Scan
🇩🇪
Vegascosmetics
2026-09-17 17:44:33
(2 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.env (Match: /.env)
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 12:11:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:10:51.635608 2026] [security2:error] [pid 337993:tid 337993] [client 213.254.175.242:23845] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.181"] [uri "/apps/.env"] [unique_id "aqvYy85w5YL28NSjfPbyFgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 04:59:01
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 00:58:40.873244 2026] [security2:error] [pid 14189:tid 14259] [client 213.254.175.242:51781] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.201"] [uri "/admin/.env"] [unique_id "aqtzgAJSxVCmEq0OjZyiCAAAAgw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 01:10:34
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:10:02.806751 2026] [security2:error] [pid 26161:tid 26161] [client 213.254.175.242:23745] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.162"] [uri "/laravel/.env"] [unique_id "aqs96klIg7dakJxX7yj4YAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 19:39:56
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 213.254.175.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 15:39:45.737332 2026] [security2:error] [pid 5091:tid 5091] [client 213.254.175.242:45307] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.6"] [uri "/vendor/.env"] [unique_id "aqrwgZGOixiSAbrn-jsdcwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack