🇩🇪
PhishDestroy
2026-06-26 15:07:02
(2 months ago)
Automated scanning of phishdestroy.io for sensitive files (.env, config, credentials). Blocked by Cl ...
show more
Automated scanning of phishdestroy.io for sensitive files (.env, config, credentials). Blocked by Cloudflare WAF rule a85b24fd4b2b4574b9ac23a37dbd7d01. 4 blocked requests. Paths: /debug/pprof/cmdline; /.env.old; /.git/config; /backend/.env. UA: Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-06-25 21:59:35
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-24.
show less
Web App Attack
SSH
Hacking
2026-06-24 22:58:02
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted] 2a10:4646:190::5d39:bfe2 (Unknown)
SQL Injection
🇳🇱
Mangelot Hosting
2026-06-24 19:19:18
(2 months ago)
(php_susp_dir) srv102 PHP in suspicious dir 2a10:4646:190::5d39:bfe2 (FR/France/-): 1 in the last 36 ...
show more
(php_susp_dir) srv102 PHP in suspicious dir 2a10:4646:190::5d39:bfe2 (FR/France/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-24 13:33:30
(2 months ago)
2a10:4646:190::5d39:bfe2 - - [24/Jun/2026:16:31:43 +0300] "GET /config.env HTTP/1.1" 404 4596 "-" "C ...
show more
2a10:4646:190::5d39:bfe2 - - [24/Jun/2026:16:31:43 +0300] "GET /config.env HTTP/1.1" 404 4596 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
2a10:4646:190::5d39:bfe2 - - [24/Jun/2026:16:33:28 +0300] "GET /app/.env HTTP/1.1" 404 3217 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 07:06:46
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 03:06:34.047894 2026] [security2:error] [pid 1917:tid 1947] [client 2a10:4646:190::5d39:bfe2:33614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ellicottville.net"] [uri "/api/.env"] [unique_id "ajuB-uUueq79B_s3jA2AmgAAAJQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 06:11:20
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 02:11:14.224418 2026] [security2:error] [pid 16935:tid 16935] [client 2a10:4646:190::5d39:bfe2:51772] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ellavandeven.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ellavandeven.com"] [uri "/wp-content/debug.log"] [unique_id "ajt1ArjUIKDClNpHpchlkgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-24 00:00:06
(2 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-06-23 23:36:20
(2 months ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 22:13:14
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 18:13:07.794391 2026] [security2:error] [pid 27801:tid 27801] [client 2a10:4646:190::5d39:bfe2:58640] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||elgarage.elpais.mx|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elgarage.elpais.mx"] [uri "/wp-content/debug.log"] [unique_id "ajsE8wqqGuOb6iHHWDkPOQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-23 19:57:41
(2 months ago)
103 requests with url.path *credentials.json
100 requests with url.path *secrets.yml
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-23 19:41:22
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 15:41:14.732988 2026] [security2:error] [pid 32705:tid 32705] [client 2a10:4646:190::5d39:bfe2:39802] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "elessen.lucid-events.com"] [uri "/.env"] [unique_id "ajrhWm_y45gV7bCGav4y-AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-06-23 19:20:03
(2 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 19:12:42
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210492) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 15:12:37.967066 2026] [security2:error] [pid 16468:tid 16468] [client 2a10:4646:190::5d39:bfe2:53808] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "elenius.com"] [uri "/.env"] [unique_id "ajrapXeTsXlayaMgazedcgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 18:47:06
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 2a10:4646:190::5d39:bfe2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:46:59.344994 2026] [security2:error] [pid 29725:tid 29725] [client 2a10:4646:190::5d39:bfe2:56460] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||elenacampo.magodarman.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elenacampo.magodarman.com"] [uri "/wp-content/debug.log"] [unique_id "ajrUo0_Av7jnSLfM8fF_hwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack