🇺🇸
WellSpring
2026-06-15 03:27:03
UTC ·
(4 months ago)
env leak on 612.today/server/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 01:15:56
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:15:50.188247 2026] [security2:error] [pid 31038:tid 31038] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:15:50.188247 2026] [security2:error] [pid 31038:tid 31038] [client 2602:fb54:9dc:::34248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.lfrmtmorris.encoremtmorris.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lfrmtmorris.encoremtmorris.com"] [uri "/wp-content/debug.log"] [unique_id "ai9SRrfX42C0752DLb0NdgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-06-14 18:48:04
UTC ·
(4 months ago)
*Port Scan* detected from 2602:fb54:9dc:: (US/United States/Missouri/North Kansas City/-/[redacted]).
Port Scan
🇺🇸
TPI-Abuse
2026-06-14 17:40:22
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:40:08.904083 2026] [security2:error] [pid 11043:tid 11043] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:40:08.904083 2026] [security2:error] [pid 11043:tid 11043] [client 2602:fb54:9dc:::55714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web237.dnchosting.com"] [uri "/backend/.env"] [unique_id "ai7neHmGGlqfR9MSGtTFjgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-14 17:33:43
UTC ·
(4 months ago)
(modsecurity) srv101 ModSecurity 2602:fb54:9dc:: (US/United States/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 17:07:39
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:07:32.532403 2026] [security2:error] [pid 32457:tid 32457] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 13:07:32.532403 2026] [security2:error] [pid 32457:tid 32457] [client 2602:fb54:9dc:::4680] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.tulsatvmemories.com"] [uri "/.env"] [unique_id "ai7f1B36vUCyAcpLQM5zggAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-06-14 16:28:35
UTC ·
(4 months ago)
2602:fb54:9dc:: - - [14/Jun/2026:18:28:34 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" "pingusmc.org"
...
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 16:05:16
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 12:05:10.252618 2026] [security2:error] [pid 15014:tid 15014] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 12:05:10.252618 2026] [security2:error] [pid 15014:tid 15014] [client 2602:fb54:9dc:::40670] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.modele18.com"] [uri "/.env"] [unique_id "ai7RNjZj6PcVMbit2pzUEAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-06-14 15:15:05
UTC ·
(4 months ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-14 15:06:56
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 11:06:51.744849 2026] [security2:error] [pid 17588:tid 17588] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 11:06:51.744849 2026] [security2:error] [pid 17588:tid 17588] [client 2602:fb54:9dc:::28150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.marisetravel.com"] [uri "/.env"] [unique_id "ai7DiwRxYcj-nn7KWqWXQQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
konseptit
2026-06-14 14:54:58
UTC ·
(4 months ago)
(mod_security) mod_security triggered on hostname [redacted] 2602:fb54:9dc:: (US/United States/-)
SQL Injection
🇳🇱
Nrbrtkls
2026-06-14 14:34:13
UTC ·
(4 months ago)
Config/secrets scanner (referer-spoofed probes)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 14:16:30
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 10:16:26.820659 2026] [security2:error] [pid 17288:tid 17288] [client 2602:fb54:9dc: ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 10:16:26.820659 2026] [security2:error] [pid 17288:tid 17288] [client 2602:fb54:9dc:::22946] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||helstone.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "helstone.com"] [uri "/wp-content/debug.log"] [unique_id "ai63uhT4t_6mA_ODIcaqPQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:53:12
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:53:05.524240 2026] [security2:error] [pid 9059:tid 9059] [client 2602:fb54:9dc::: ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:53:05.524240 2026] [security2:error] [pid 9059:tid 9059] [client 2602:fb54:9dc:::41836] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.emgeorge.com"] [uri "/.env"] [unique_id "ai6yQVKC8pN5R5KOAalD2wAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 13:33:57
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:33:51.803755 2026] [security2:error] [pid 7902:tid 7902] [client 2602:fb54:9dc::: ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fb54:9dc:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:33:51.803755 2026] [security2:error] [pid 7902:tid 7902] [client 2602:fb54:9dc:::41752] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.mickmashbir.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.mickmashbir.com"] [uri "/wp-content/debug.log"] [unique_id "ai6tvy27gZRVwHVf2x5qHwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack