🇺🇸
TPI-Abuse
2026-11-13 15:29:27
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:29:24.500463 2026] [security2:error] [pid 10182:tid 10182] [client 40.64.121.102:51346] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:29:24.500463 2026] [security2:error] [pid 10182:tid 10182] [client 40.64.121.102:51346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "idmadventures.com"] [uri "/.env"] [unique_id "avcs1IOVo-OJupCW6lF0AwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 02:14:41
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:14:34.597755 2026] [security2:error] [pid 11490:tid 11506] [client 40.64.121.102:51739] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 21:14:34.597755 2026] [security2:error] [pid 11490:tid 11506] [client 40.64.121.102:51739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stephanietobola.com"] [uri "/.env"] [unique_id "avZyipFLKRAGzK4gv9mXWQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
SOC [GOLINE SA]
2026-11-13 02:03:58
UTC ·
(1 day ago)
FortiGate detected brute force login attempt from IPv4 address 40.64.121.102
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-11-13 01:43:52
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:43:45.586476 2026] [security2:error] [pid 3843:tid 3843] [client 40.64.121.102:28221] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:43:45.586476 2026] [security2:error] [pid 3843:tid 3843] [client 40.64.121.102:28221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stananddana.com"] [uri "/.env"] [unique_id "avZrUepVUvMLfKZ_Qkh7bgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
SOC [GOLINE SA]
2026-11-13 01:32:19
UTC ·
(1 day ago)
FortiGate IPS: AndroxGh0st.Malware (severity high)
Hacking
🇺🇸
TPI-Abuse
2026-11-13 01:22:27
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:22:20.059785 2026] [security2:error] [pid 22304:tid 22360] [client 40.64.121.102:29621] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:22:20.059785 2026] [security2:error] [pid 22304:tid 22360] [client 40.64.121.102:29621] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nopictures.org"] [uri "/.env"] [unique_id "avZmTEyV7VVth1qA3sOhkQAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Blamdom
2026-11-13 01:01:26
UTC ·
(1 day ago)
Secret/config-file recon: requested /.env. 2 HTTP request(s), 2026-11-13 01:01:26 to 01:01:27 UTC (1s).
Requests (method path -> status xcount):
GET /.env -> 301
POST / -> 301
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge ...
show more
Secret/config-file recon: requested /.env. 2 HTTP request(s), 2026-11-13 01:01:26 to 01:01:27 UTC (1s).
Requests (method path -> status xcount):
GET /.env -> 301
POST / -> 301
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
show less
Hacking
Bad Web Bot
Web App Attack
2026-11-12 23:34:03
UTC ·
(1 day ago)
[ns65.kdns.gr] httpd-config-scan: sites=emeod.gr; logs=/var/log/httpd/domains/emeod.gr.log; samples=/.env | fast_lane=true kernel_at=2026-11-12T23:32:42+00:00 | requests=1
Hacking
Web App Attack
🇺🇸
mnsf
2026-11-12 22:05:04
UTC ·
(1 day ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇩🇪
LRob
2026-11-12 16:48:38
UTC ·
(1 day ago)
Secret file probe | method: GET | path: /.env | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 16:34:12
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:34:08.720039 2026] [security2:error] [pid 12963:tid 12963] [client 40.64.121.102:35466] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:34:08.720039 2026] [security2:error] [pid 12963:tid 12963] [client 40.64.121.102:35466] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newfocustv.com"] [uri "/.env"] [unique_id "avXqgG59KYqFjefyRBDiwQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-12 16:31:45
UTC ·
(1 day ago)
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 40.64.121.102 - - [12/Nov/2026:17:31:30 +0100] "GET /.env HTTP/1.1" 301 475 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like ...
show more
[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 40.64.121.102 - - [12/Nov/2026:17:31:30 +0100] "GET /.env HTTP/1.1" 301 475 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 16:13:51
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:13:44.882710 2026] [security2:error] [pid 15040:tid 15040] [client 40.64.121.102:15709] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:13:44.882710 2026] [security2:error] [pid 15040:tid 15040] [client 40.64.121.102:15709] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "naturalunfinishedfurniture.com"] [uri "/.env"] [unique_id "avXluOCRn9sonz0gqrGhHQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
creechy
2026-11-12 16:03:31
UTC ·
(1 day ago)
40.64.121.102 - - [12/Nov/2026:08:03:22 -0800] "GET /.env HTTP/1.1" 403 689 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-12 15:37:17
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:37:11.657581 2026] [security2:error] [pid 24882:tid 24882] [client 40.64.121.102:46009] M ...
show more
(mod_security) mod_security (id:210492) triggered by 40.64.121.102 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:37:11.657581 2026] [security2:error] [pid 24882:tid 24882] [client 40.64.121.102:46009] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "safeharbourfund.com"] [uri "/.env"] [unique_id "avXdJ38042AOibdUCpkRYgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
