🇺🇸
mawan
2026-10-09 08:44:45
(4 days ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
2026-09-25 11:00:02
(2 weeks ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 10:54:37
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 06:54:33.154604 2026] [security2:error] [pid 22939:tid 22939] [client 69.6.196.92:21514] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "billystuff.net"] [uri "/.env"] [unique_id "arZS6YcIsffsin4FH_-9wAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 08:45:09
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 04:45:00.849839 2026] [security2:error] [pid 23845:tid 23845] [client 69.6.196.92:28206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "leewis.com"] [uri "/.env"] [unique_id "arY0jCEDFIWuidsnziOHKAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-25 08:00:45
(2 weeks ago)
[server.tmg.gr] httpd-config-scan: sites=www.infectionsinstitute.com; logs=/var/log/httpd/domains/in ...
show more
[server.tmg.gr] httpd-config-scan: sites=www.infectionsinstitute.com; logs=/var/log/httpd/domains/infectionsinstitute.com.log; samples=/.env
show less
Hacking
Web App Attack
🇺🇸
Rip
2026-09-25 06:16:08
(2 weeks ago)
Restricted File Access Attempts
Port Scan
Web App Attack
🇩🇪
LRob
2026-09-25 05:19:15
(2 weeks ago)
This address is looking for secret files on our sites: .git directories, .env files, credential and ...
show more
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /.env | 2026-09-25 05:19 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 22:54:14
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 18:54:07.226895 2026] [security2:error] [pid 24345:tid 24345] [client 69.6.196.92:37830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teknna.com"] [uri "/wp-config.php.bak"] [unique_id "arMHDzBBcwyW4MdS032LrQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 22:31:51
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 18:31:47.416358 2026] [security2:error] [pid 19108:tid 19108] [client 69.6.196.92:41932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brazilianbottom.com"] [uri "/wp-config.php.bak"] [unique_id "arMB0xHQY6j8kt0KbFew9AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 20:39:05
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:38:59.394516 2026] [security2:error] [pid 23155:tid 23155] [client 69.6.196.92:18854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.solidthought.com"] [uri "/wp-config.php.bak"] [unique_id "arLnY9JG9FbW7OH1SDun9wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:47:43
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:47:35.887647 2026] [security2:error] [pid 18890:tid 18890] [client 69.6.196.92:48172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thorhauer.com"] [uri "/wp-config.php.bak"] [unique_id "arLbV5xG679gNSz_jT3IDgAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:24:10
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:24:03.852471 2026] [security2:error] [pid 23826:tid 23826] [client 69.6.196.92:38596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kampinenlaw.com"] [uri "/wp-config.php.bak"] [unique_id "arLV08ejSWncb81ilU0MjgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-22 18:50:18
(3 weeks ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 69.6.196.92 - - [22/Sep/2026:20:50:17 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 537 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:45:20
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:45:12.917485 2026] [security2:error] [pid 20692:tid 20692] [client 69.6.196.92:11326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bgraph.com"] [uri "/wp-config.php.bak"] [unique_id "arLMuAvh_W5-Nf6cHyFITQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:33:22
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 69.6.196.92 (sh00047.hostgator.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:33:18.778976 2026] [security2:error] [pid 16862:tid 16862] [client 69.6.196.92:16858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "srich.com"] [uri "/wp-config.php.bak"] [unique_id "arK73tmvcazFA_NydY2lxAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
