🇫🇷
Baking333
2026-08-25 04:10:10
(2 hours ago)
[redacted] 45.88.91.2 - - [25/Aug/2026:04:11:16 +0100] "GET /.env HTTP/1.1" 302 6768 0/47987 "-" "Mo ...
show more
[redacted] 45.88.91.2 - - [25/Aug/2026:04:11:16 +0100] "GET /.env HTTP/1.1" 302 6768 0/47987 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" [redacted] 45.88.91.2 - - [25/Aug/2026:05:10:08 +0100] "GET /.env HTTP/1.1" 302 6758 0/49827 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 03:53:34
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 23:53:26.395531 2026] [security2:error] [pid 28975:tid 28975] [client 45.88.91.2:49234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "appalachianfolkmagician.com"] [uri "/.env"] [unique_id "ao0RtnU0p0IatLRutFbPHAAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 02:15:37
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 2002:2d58:5b02::2d58:5b02 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2002:2d58:5b02::2d58:5b02 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 22:15:28.994068 2026] [security2:error] [pid 6994:tid 6994] [client 2002:2d58:5b02::2d58:5b02:51280] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebradleyclinic.com"] [uri "/.env"] [unique_id "aoz6wDWxOCyxlmL5uKvpGAAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 22:20:56
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 18:20:49.504338 2026] [security2:error] [pid 9177:tid 9177] [client 45.88.91.2:64724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebradleyclinic.com"] [uri "/.env"] [unique_id "aozDwf_CuQv-cQUHIiZhngAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-24 22:02:26
(8 hours ago)
Auto-ban: >3000 req/min op 2026-08-24
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-08-24 20:14:17
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.88.91.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 16:14:11.652280 2026] [security2:error] [pid 5852:tid 5852] [client 45.88.91.2:54274] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "terrybeachmusic.com"] [uri "/.env"] [unique_id "aoymEzvR1jPEZbF4svyGQAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-08-24 18:53:13
(11 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack
🇺🇸
MPL
2026-05-02 08:32:32
(3 months ago)
tcp/2087
Port Scan
🇳🇵
radheykrishna.com.np
2026-05-02 08:32:08
(3 months ago)
May 2 14:17:07 kernel: [1200454.234934] [UFW BLOCK] IN=ens160 OUT= SRC=45.88.91.2 LEN=40 TOS=0x00 P ...
show more
May 2 14:17:07 kernel: [1200454.234934] [UFW BLOCK] IN=ens160 OUT= SRC=45.88.91.2 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=60047 DPT=2087 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
2026-05-02 08:30:08
(3 months ago)
unsolicited connect TCP dport 2087 (sport 51527)
Hacking
2026-04-19 05:04:59
(4 months ago)
Aggressive web scan
Web App Attack