2026-10-16 11:05:54
(2 days ago)
"GET /protected/.env HTTP/1.1"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 07:29:26
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 03:29:14.595223 2026] [security2:error] [pid 30593:tid 30593] [client 31.171.130.35:34351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.238"] [uri "/new/.env"] [unique_id "atHSSgB4PnDIOAorTnrXDwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 04:09:30
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 00:09:15.235686 2026] [security2:error] [pid 6598:tid 6598] [client 31.171.130.35:61323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.122"] [uri "/core/.env"] [unique_id "atGja2PgBTtdRUuhmhrG7gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 03:29:44
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 23:29:22.124155 2026] [security2:error] [pid 23258:tid 23258] [client 31.171.130.35:30215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.56"] [uri "/www/.env"] [unique_id "atGaEjC3jO_zknAoNFhIAgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 01:53:03
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 21:52:47.852186 2026] [security2:error] [pid 14995:tid 15021] [client 31.171.130.35:60867] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.23"] [uri "/laravel/.env"] [unique_id "atGDb-LBfmLzSRRM4DLI_gAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 01:21:12
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 21:20:55.532865 2026] [security2:error] [pid 6465:tid 6465] [client 31.171.130.35:36475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.170"] [uri "/.env"] [unique_id "atF79-ahNUaYLOIykYmOYQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 00:19:58
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 20:19:42.706177 2026] [security2:error] [pid 28980:tid 28980] [client 31.171.130.35:36275] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.213"] [uri "/laravel/.env"] [unique_id "atFtniHQWOPy5SPy8PHlyAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 23:51:03
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:50:44.590989 2026] [security2:error] [pid 27415:tid 27415] [client 31.171.130.35:54009] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.88"] [uri "/src/.env"] [unique_id "atFm1PEcPiWb1KN6JW2BnAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 22:41:06
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 18:40:45.107158 2026] [security2:error] [pid 23659:tid 23767] [client 31.171.130.35:28643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.128"] [uri "/base/.env"] [unique_id "atFWbdX6LkqhJyXeGY97bwAAAk8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 19:17:40
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 15:17:07.769402 2026] [security2:error] [pid 14440:tid 14440] [client 31.171.130.35:34587] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.136"] [uri "/vendor/laravel/.env"] [unique_id "atEms8z-ulXshNBxV5CLKQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-10 05:09:04
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Web Spam (Form Abuse). Unsolicite ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Web Spam (Form Abuse). Unsolicited bulk message (Form Spam) captured. Evidence:
HOST: sweetpuddingtrap.online | URI: /contact.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0 | BODY: name=Joseph+Miller&company_website=&email=peterwijnmaalen%40gmail.com&message=I+would+like+more+information.+Please+contact+me+by+email+%E2%80%94+enterprise+digital+solutions.
--- SPAM DATA ---
(From: [email protected] )
I would like more information. Please contact me by email — enterprise digital solutions.
show less
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 14:48:39
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 31.171.130.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 10:48:33.003325 2026] [security2:error] [pid 21163:tid 21163] [client 31.171.130.35:55765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||scaleiq.group.smartstylehair.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scaleiq.group.smartstylehair.com"] [uri "/web/wp-json/wp/v2/users/"] [unique_id "asEVwYfr3bjaO1PfOBAXpAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
borbolla
2026-10-03 07:24:15
(2 weeks ago)
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp/wp-includes/wlwmanifes ...
show more
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1"
show less
Web App Attack
Bad Web Bot
🇵🇱
Budyn
2026-10-03 04:09:48
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: elastic.goblinpot.tech | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-02 18:25:33
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: billing.astropot.online | URI: //xmlrpc.php?rsd | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
