🇺🇸
TPI-Abuse
2026-10-28 19:27:27
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:27:21.744134 2026] [security2:error] [pid 6831:tid 6831] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:27:21.744134 2026] [security2:error] [pid 6831:tid 6831] [client 79.127.182.90:21629] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "birchstreetstorage.com"] [uri "/.env.example"] [unique_id "auJMmejP9-Fb3NHNikcRkAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
tsZero
2026-10-28 18:04:06
(5 hours ago)
Scan example: path=/.env.example status=404
Hacking
🇺🇸
francelink.fr
2026-10-28 15:01:28
(8 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-28T14:59:18.000Z.
Web App Attack
🇳🇱
Alt255
2026-10-28 12:57:53
(10 hours ago)
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 79.127.182.90 - - [28/Oct/2026:13:57:46 +0100] "GET /.env.example HTTP/1.1" 404 7914 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) ...
show more
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 79.127.182.90 - - [28/Oct/2026:13:57:46 +0100] "GET /.env.example HTTP/1.1" 404 7914 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604."
...
show less
Bad Web Bot
Web App Attack
🇬🇧
WebNiraj
2026-10-28 12:09:20
(11 hours ago)
(mod_security) mod_security (id:949110) triggered by 79.127.182.90 (HU/Hungary/unn-79-127-182-90.datapacket.com): 5 in the last 3600 secs [SIGMA]
Brute-Force
🇳🇱
Mangelot Hosting
2026-10-28 10:27:57
(12 hours ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 79.127.182.90 (HU/Hungary/unn-79-127-182-90.datapacket.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
2026-10-28 08:46:06
(14 hours ago)
"GET /.env HTTP/2.0"
Hacking
Web App Attack
🇿🇦
conure.sh
2026-10-28 07:14:17
(15 hours ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 1 domain(s) in 1s
Web App Attack
🇺🇸
craudiovizai
2026-10-28 06:30:33
(16 hours ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /.env.example, /.env. Blocked at the edge.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-28 05:49:15
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 01:49:07.568134 2026] [security2:error] [pid 23511:tid 23640] ...
show more
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 01:49:07.568134 2026] [security2:error] [pid 23511:tid 23640] [client 79.127.182.90:30581] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "review.n2play.net"] [uri "/.env.example"] [unique_id "auGM00IPYxtb6ENLf4WjOAAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-28 03:22:12
(19 hours ago)
Automated report: 2 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: /.env, /.env.example
Bad Web Bot
Web App Attack
🇩🇪
wpadm4
2026-10-28 02:40:00
(20 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 02:21:20
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 22:21:16.668910 2026] [security2:error] [pid 31409:tid 31409] ...
show more
(mod_security) mod_security (id:210492) triggered by 79.127.182.90 (unn-79-127-182-90.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 22:21:16.668910 2026] [security2:error] [pid 31409:tid 31409] [client 79.127.182.90:43229] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shafie.net"] [uri "/.env.example"] [unique_id "auFcHLWJ-TViuY6dYQ8VfAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-28 02:16:21
(20 hours ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 79.127.182.90 - - \[28/Oct/2026:03:16:00 +0100\] "GET /.env.example HTTP/2.0" 301 466 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit ...
show more
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 79.127.182.90 - - \[28/Oct/2026:03:16:00 +0100\] "GET /.env.example HTTP/2.0" 301 466 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.3124.85"
...
show less
Bad Web Bot
Web App Attack
2026-10-28 00:30:05
(22 hours ago)
suspicious request in access.log
Web App Attack
