🇺🇸
TPI-Abuse
2026-07-22 13:06:55
(13 minutes ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 09:06:51.056036 2026] [security2:error] [pid 784574:tid 784574] [client 2a09:bac1:76c0:460::5e:70:20150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.behrooz.org"] [uri "/.env"] [unique_id "amDAa6MfXjYX78vm2CHtIQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
Starburst SysOp Team
2026-07-22 12:38:40
(41 minutes ago)
Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-vie6- ...
show more
Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-vie6-1)
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-22 12:09:02
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 08:08:56.172766 2026] [security2:error] [pid 14471:tid 14471] [client 2a09:bac1:76c0:460::5e:70:32580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.perlcreativedesign.com"] [uri "/.env"] [unique_id "amCy2HOAv19RUN-UEASlRAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
r4fo.com
2026-07-20 20:00:40
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
2026-07-20 14:33:51
(1 day ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 19:06:37
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 15:06:29.967299 2026] [security2:error] [pid 26644:tid 26644] [client 2a09:bac1:76c0:460::5e:70:60350] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.dragonflytunes.com"] [uri "/.env"] [unique_id "al0gNVR8cFeQEiiKUfzABAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 20:23:12
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 16:23:07.928252 2026] [security2:error] [pid 1288399:tid 1288399] [client 2a09:bac1:76c0:460::5e:70:44798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mastersonsmotel.ca"] [uri "/.env"] [unique_id "alqPK_jxNQ36hvPRfy72AAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 21:19:13
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 17:19:07.637267 2026] [security2:error] [pid 6394:tid 6394] [client 2a09:bac1:76c0:460::5e:70:47510] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.theamarals.com"] [uri "/.env"] [unique_id "allKy5PLAAywnyWrCAoBmgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Ba-Yu
2026-07-16 20:20:26
(5 days ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 19:26:10
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 15:26:06.765767 2026] [security2:error] [pid 16977:tid 16977] [client 2a09:bac1:76c0:460::5e:70:15570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.odinathletes.com"] [uri "/.env"] [unique_id "alkwThagz2tKFF1Ch34YtgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-07-13 23:09:52
(1 week ago)
138 requests with url.path *config.json
122 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-07-13 22:30:08
(1 week ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-13 21:59:58
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 17:59:53.972448 2026] [security2:error] [pid 2729:tid 2729] [client 2a09:bac1:76c0:460::5e:70:12800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.clinchspurs.com"] [uri "/.env"] [unique_id "alVf2fNGHS8BM27FAmFtvgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-13 20:41:09
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac1:76c0:460::5e:70 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 16:41:05.674406 2026] [security2:error] [pid 2268810:tid 2268810] [client 2a09:bac1:76c0:460::5e:70:11094] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.toepfer.org"] [uri "/.env"] [unique_id "alVNYTqlVAZbgXK6wq2o9gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-07-13 20:04:50
(1 week ago)
2026/07/13 20:04:48 [error] 3202983#3202983: *373641970 access forbidden by rule, client: 2a09:bac1: ...
show more
2026/07/13 20:04:48 [error] 3202983#3202983: *373641970 access forbidden by rule, client: 2a09:bac1:76c0:460::5e:70, server: bonocom.org, request: "GET /.env HTTP/2.0", host: "bonocom.org"
2026/07/13 20:04:49 [error] 3202980#3202980: *373642004 access forbidden by rule, client: 2a09:bac1:76c0:460::5e:70, server: bonocom.org, request: "GET /.aws/credentials HTTP/2.0", host: "bonocom.org"
2026/07/13 20:04:49 [error] 3202983#3202983: *373641963 access forbidden by rule, client: 2a09:bac1:76c0:460::5e:70, server: bonocom.org, request: "GET /.env.staging HTTP/2.0", host: "bonocom.org"
...
show less
Web App Attack