🇺🇸
TPI-Abuse
2026-09-25 00:18:41
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 20:18:37.579504 2026] [security2:error] [pid 23722:tid 23722] [client 2a02:4780:4:9e06::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.top-brand.us"] [uri "/.env.save"] [unique_id "arW93YXTLQGVNbKj1PTgEQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-24 20:08:09
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 16:08:03.823833 2026] [security2:error] [pid 3063:tid 3063] [client 2a02:4780:4:9e06::1:55700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aimer.es.aticom.es"] [uri "/wp-config.php.orig"] [unique_id "arWDI89vyn8sPJuT8S0gMAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-24 18:49:26
(23 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-09-24 02:09:06
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 22:09:03.167262 2026] [security2:error] [pid 3934:tid 3980] [client 2a02:4780:4:9e06::1:48736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.visionforandfromchildren.org"] [uri "/wp-config.php.bak"] [unique_id "arSGP-V-Pf-El3Y1E4J0WwAAAVc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-09-23 18:53:41
(1 day ago)
Blocked by Conn-Monitor: env-probing
Web App Attack
Hacking
🇫🇮
Rauno Asp
2026-09-23 03:40:51
(2 days ago)
Automated .env credentials scanning attempt detected by honeypot on elbasanapartments.al
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:44:46
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:44:33.854389 2026] [security2:error] [pid 2005:tid 2005] [client 2a02:4780:4:9e06::1:50186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oruhu.org"] [uri "/wp-config.php.old"] [unique_id "arLaoUvriU4V_4o-YAkMRAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:01:24
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:01:20.074554 2026] [security2:error] [pid 30479:tid 30479] [client 2a02:4780:4:9e06::1:55754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cassimandabdallah.williamgilcher.com"] [uri "/wp-config.php.bak"] [unique_id "arKYQOY9RE-XHS2xYdhFLwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-09-21 23:23:34
(3 days ago)
Blocked by ConnMonitor
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:12:22
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:12:19.060748 2026] [security2:error] [pid 8468:tid 8488] [client 2a02:4780:4:9e06::1:32934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.whitecrosslibrary.aafm.us"] [uri "/wp-config.php.bak"] [unique_id "arG503qvK6KaCzEV_BABVgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-20 21:07:33
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇫🇮
wpwoodo
2026-09-18 14:55:49
(1 week ago)
Webpage crawler
Bad Web Bot
2026-09-18 08:49:41
(1 week ago)
2a02:4780:4:9e06::1 - - [18/Sep/2026:16:49:40 +0800] "GET /.env.bak HTTP/1.1" 200 30690 "-" "Mozilla ...
show more
2a02:4780:4:9e06::1 - - [18/Sep/2026:16:49:40 +0800] "GET /.env.bak HTTP/1.1" 200 30690 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 05:53:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a02:4780:4:9e06::1 (srv1452447.hstgr.cloud): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 01:53:31.097931 2026] [security2:error] [pid 7463:tid 7463] [client 2a02:4780:4:9e06::1:46898] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cnphilos.com"] [uri "/wp-config.php.save"] [unique_id "aqzR221t7R4ieyMybwq9YgAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-09-18 04:35:05
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.budyn.xyz | URI: /.env.bak | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
