🇺🇸
TPI-Abuse
2026-10-18 00:12:23
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:12:18.483003 2026] [security2:error] [pid 9713:tid 9713] [client 2602:fa59:2:41e1::1:58153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sicktracks.com"] [uri "/.env"] [unique_id "atQO4riZIXhHS5kJQkbhpAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:21:39
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:21:32.393754 2026] [security2:error] [pid 8514:tid 8514] [client 2602:fa59:2:41e1::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.com"] [uri "/.env"] [unique_id "atPm3M01LnyKbDW9KhiIiwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 18:09:44
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 14:09:35.077128 2026] [security2:error] [pid 32181:tid 32181] [client 2602:fa59:2:41e1::1:55723] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sbxyz.net"] [uri "/.env"] [unique_id "atO534Uo9F4yowabAObHZQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-10-17 17:39:40
(9 hours ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of ...
show more
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-17 17:39 UTC.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 15:00:52
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 11:00:43.614348 2026] [security2:error] [pid 9548:tid 9548] [client 2602:fa59:2:41e1::1:54636] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lolycarrillo.com"] [uri "/.env"] [unique_id "atONm4NTZJG3xC0QLCy4mAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 13:20:39
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:20:33.674914 2026] [security2:error] [pid 21826:tid 21826] [client 2602:fa59:2:41e1::1:61366] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rodandreelpiercam.com"] [uri "/.env"] [unique_id "atN2IURD9H7w3yqEkQTDeQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-10-17 09:00:57
(18 hours ago)
ave-17 : Block hidden directories=>/.env(/)
Hacking
🇨🇭
YF
2026-10-17 09:00:28
(18 hours ago)
Environment file probe
Web App Attack
2026-10-17 07:28:03
(19 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇳🇱
Alt255
2026-10-17 06:25:27
(20 hours ago)
[ti-03ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-03ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2602:fa59:2:41e1::1 - - [17/Oct/2026:08:25:13 +0200] "GET /.env HTTP/1.1" 301 487 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 04:42:19
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:42:12.711485 2026] [security2:error] [pid 9910:tid 9910] [client 2602:fa59:2:41e1::1:54822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nemoscientific.com"] [uri "/.env"] [unique_id "atL8pCOz0C0XRqj4GrtYQgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 03:58:21
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 23:58:14.915727 2026] [security2:error] [pid 8071:tid 8071] [client 2602:fa59:2:41e1::1:50000] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smokehouseeatery.ca"] [uri "/.env"] [unique_id "atLyVjXNMgMEx07piSCfewAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 03:41:23
(23 hours ago)
(mod_security) mod_security (id:949110) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:949110) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 23:41:17.899180 2026] [security2:error] [pid 30998:tid 30998] [client 2602:fa59:2:41e1::1:57591] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "euro-theatre.com"] [uri "/.env"] [unique_id "atLuXV6Hee5la5uPEps-ggAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-17 03:06:59
(23 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 02:15:13
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:2:41e1::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 22:15:06.537230 2026] [security2:error] [pid 32058:tid 32058] [client 2602:fa59:2:41e1::1:49328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ohwaitiforgot.com"] [uri "/.env"] [unique_id "atLaKh4UojAleIaO4kQazgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
