🇺🇸
TPI-Abuse
2026-09-18 13:04:06
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 09:03:58.030451 2026] [security2:error] [pid 3820:tid 3820] [client 223.166.12.235:33811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "helpkccare.org"] [uri "/.env"] [unique_id "aq02vscGjNy73n2y0EZLHwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
securejdprop
2026-09-18 12:03:49
(7 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access.
Hacking
Web App Attack
🇩🇪
Viveronese
2026-09-18 10:51:18
(8 hours ago)
HTTP vulnerability scanning
Web App Attack
🇨🇿
ddw
2026-09-18 07:27:18
(12 hours ago)
Access Violation Attempts - Multiple 403 Forbidden responses.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 07:06:50
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 03:06:46.234573 2026] [security2:error] [pid 14123:tid 14123] [client 223.166.12.235:59452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ferareta.com.ar"] [uri "/.env"] [unique_id "aqzjBs16Z6UJNZaGwH5zcQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-18 06:05:08
(13 hours ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇨🇭
4server
2026-09-18 02:34:33
(17 hours ago)
[FriSep1804:34:27.4180942026][security2:error][pid1095088:tid1095214][client223.166.12.235:0]ModSecu ...
show more
[FriSep1804:34:27.4180942026][security2:error][pid1095088:tid1095214][client223.166.12.235:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"edilmarra.ch\"][uri\"/.env\"][unique_id\"aqyjMy2jIaaqEDZUzFNUcgAAAVQ\"]
show less
Hacking
Web App Attack
🇳🇱
Alt255
2026-09-18 01:00:56
(18 hours ago)
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 223.166.12.235 - - [18/Sep/2026:03:00:51 +0200] "GET /.env HTTP/1.1" 403 6257 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 00:21:36
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 20:21:30.542535 2026] [security2:error] [pid 30179:tid 30179] [client 223.166.12.235:50828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "directcch.com"] [uri "/.env"] [unique_id "aqyECplQXbe_6PYYBiVzHwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-17 22:00:02
(21 hours ago)
Auto-ban: >3000 req/min op 2026-09-17
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-17 16:00:39
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 12:00:31.143408 2026] [security2:error] [pid 31956:tid 32061] [client 223.166.12.235:54590] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "besfixedwireless.com"] [uri "/.env"] [unique_id "aqwOn3G0QJgJG1cVkNm7ZQAAANI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 14:08:11
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 10:08:07.031825 2026] [security2:error] [pid 4112:tid 4112] [client 223.166.12.235:55589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apsni.net"] [uri "/.env"] [unique_id "aqv0R6taktrp256lvrLY8gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 13:32:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 223.166.12.235 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 09:32:06.349970 2026] [security2:error] [pid 16863:tid 16863] [client 223.166.12.235:36347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "altruaglobalsolutions.com"] [uri "/.env"] [unique_id "aqvr1ikMoFFErSZJEXnZbAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
k3rn3l109
2026-09-17 07:33:35
(1 day ago)
Sentinel honeypot: opencanary-redis hit on fake Redis service (server-01-CA) UA=opencanary
Port Scan
Hacking