🇺🇸
ambor
2026-03-28 19:20:08
(2 months ago)
Honeypot triggered on tcpdata.com - Attempted to access /.env.production (config_file_probe). User-A ...
show more
Honeypot triggered on tcpdata.com - Attempted to access /.env.production (config_file_probe). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
show less
Web App Attack
🇬🇧
consul.to
2026-02-15 12:50:51
(3 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 12:45:48
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:45:42.841694 2026] [security2:error] [pid 17746:tid 17771] [client 65.111.5.63:9923] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "toastandfigs.com"] [uri "/new/.git/config"] [unique_id "aZG_9nFGPLXLwlPPyppTygAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 12:28:37
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:28:23.895979 2026] [security2:error] [pid 20076:tid 20076] [client 65.111.5.63:19179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "title23.com"] [uri "/new/.git/config"] [unique_id "aZG755u3wtK6qMuCaR4djAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 06:06:34
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 01:06:28.854248 2026] [security2:error] [pid 23287:tid 23327] [client 65.111.5.63:33829] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sylvestconsulting.com"] [uri "/.git/config"] [unique_id "aZFiZI6jtjP5LgwlR2nYhAAAAcY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 05:51:05
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:51:00.714283 2026] [security2:error] [pid 351332:tid 351332] [client 65.111.5.63:32775] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "swetzer.net"] [uri "/api/.env"] [unique_id "aZFexAn7KOqN01xV7jiz9AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 05:26:06
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:26:01.159465 2026] [security2:error] [pid 23668:tid 23668] [client 65.111.5.63:37063] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "supportourlibrary.org"] [uri "/admin/.git/config"] [unique_id "aZFY6bQ9IziUDKPsAxjpTgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 04:53:15
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:53:10.841375 2026] [security2:error] [pid 8181:tid 8181] [client 65.111.5.63:15493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "suffolksystems.com"] [uri "/backend/.env"] [unique_id "aZFRNgQ7FvWLOUAI73-UJwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-15 04:15:02
(3 months ago)
Bot / scanning and/or hacking attempts: GET /app/.env HTTP/1.1, GET /test/.git/config HTTP/1.1, GET ...
show more
Bot / scanning and/or hacking attempts: GET /app/.env HTTP/1.1, GET /test/.git/config HTTP/1.1, GET /v2/.git/config HTTP/1.1, GET /config/.env HTTP/1.1, GET /api/.git/config HTTP/1.1, GET /.env.staging HTTP/1.1, GET /admin/.env HTTP/1.1, GET /.env HTTP/1.1, GET /frontend/.env HTTP/1.1, GET /backup/.git/config HTTP/1.1, GET /dev/.git/config HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-02-15 03:05:37
(3 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-15 02:45:29
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 21:45:26.135556 2026] [security2:error] [pid 729628:tid 729628] [client 65.111.5.63:45585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sprektech.com"] [uri "/.env"] [unique_id "aZEzRjE6_TcPsLESBkdgsAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
INTEQ
2026-02-15 02:32:22
(3 months ago)
Web attack from 65.111.5.63
Web App Attack
🇺🇸
myagent.site
2026-02-15 01:47:19
(3 months ago)
Blocking for trying to access an exploit file: /dev/.git/config
Hacking
2026-02-15 01:20:54
(3 months ago)
(mod_security) mod_security triggered on hostname [redacted] 65.111.5.63 (US/United States/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-02-15 00:30:36
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 19:30:31.805275 2026] [security2:error] [pid 28378:tid 28378] [client 65.111.5.63:12997] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lozzy.net"] [uri "/.env"] [unique_id "aZETp64FLZctlYAsrcOWIwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack