🇳🇱
homeshowdomain.nl
2026-08-02 22:00:32
UTC ·
(3 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-01.
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-08-02 12:05:17
UTC ·
(3 months ago)
csagent: score 20.5: 404 noise floor x2, secrets grab x2; 1 domain(s) in 0s
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-01 22:00:23
UTC ·
(3 months ago)
Auto-ban: >3000 req/min op 2026-08-01
Web App Attack
SSH
Hacking
🇺🇸
Matthew Ping
2026-08-01 17:30:02
UTC ·
(3 months ago)
ModSecurity rule 949110 triggered on dedicated4785. Web application attack blocked by CSF/LFD.
Web App Attack
Hacking
2026-08-01 17:25:03
UTC ·
(3 months ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 17:08:40
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:08:36.270351 2026] [security2:error] [pid 1066195:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:08:36.270351 2026] [security2:error] [pid 1066195:tid 1066195] [client 35.203.16.220:43788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eqmarino.tecnoconce.com"] [uri "/.env.bak"] [unique_id "am4oFM5BePl64vTDMM-RhwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-08-01 17:07:46
UTC ·
(3 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 16:50:31
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 12:50:24.082118 2026] [security2:error] [pid 2424913:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 12:50:24.082118 2026] [security2:error] [pid 2424913:tid 2424913] [client 35.203.16.220:46604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noscentpro.com"] [uri "/.env.local"] [unique_id "am4j0DnpCNfGAtinmqASRgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
tentwentyfour
2026-08-01 16:30:27
UTC ·
(3 months ago)
Blocked for probing for sensitive web application components
Brute-Force
Web App Attack
🇩🇪
XICTRON
2026-08-01 16:25:08
UTC ·
(3 months ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇫🇷
masterguru
2026-08-01 15:51:47
UTC ·
(3 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:50:04
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:49:56.935061 2026] [security2:error] [pid 708458:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:49:56.935061 2026] [security2:error] [pid 708458:tid 708475] [client 35.203.16.220:33460] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ultratecnia.onernet.com"] [uri "/.env.bak"] [unique_id "am4VpB3PurNDA53-AL767AAAAcI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:30:41
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:30:37.301852 2026] [security2:error] [pid 8175:tid 8 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:30:37.301852 2026] [security2:error] [pid 8175:tid 8175] [client 35.203.16.220:46636] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.itsopossum.flyingdodostudio.com"] [uri "/.env.bak"] [unique_id "am4RHXTOZRj1g9gJ904cigAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 15:11:14
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:11:06.424391 2026] [security2:error] [pid 2862166:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.203.16.220 (220.16.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:11:06.424391 2026] [security2:error] [pid 2862166:tid 2862166] [client 35.203.16.220:52544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.tempsetters.com"] [uri "/.env"] [unique_id "am4MiiVgB_n_lDkrTXsBvQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-01 15:07:01
UTC ·
(3 months ago)
Automated web scanner. Requested suspicious paths: /.env.local | /.env.bak | /.env.old | /.env.example | /.env.dev | /.env.production | /.env | /.env.backup | /.env.save | /.env.prod. UTC: 2026-08-01 14:08:04.
Web App Attack