🇳🇱
Mangelot Hosting
2026-10-20 23:41:17
(2 hours ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 80.76.49.226 (US/United States/- ...
show more
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 80.76.49.226 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 23:15:32
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.76.49.226 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 80.76.49.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 19:15:26.924097 2026] [security2:error] [pid 19533:tid 19533] [client 80.76.49.226:55248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "terrybeachmusic.com"] [uri "/.env"] [unique_id "atf2Du5E4CvV4Z1m9U4qkQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-20 22:02:21
(3 hours ago)
Auto-ban: >3000 req/min op 2026-10-20
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-20 21:49:36
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 2002:504c:31e2::504c:31e2 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2002:504c:31e2::504c:31e2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 17:49:27.753461 2026] [security2:error] [pid 13574:tid 13574] [client 2002:504c:31e2::504c:31e2:62722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebradleyclinic.com"] [uri "/.env"] [unique_id "atfh54-5Ib4orbfsziAxlgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
zam
2026-10-20 20:44:50
(5 hours ago)
80.76.49.226 - - [20/Oct/2026:20:44:45 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.p ...
show more
80.76.49.226 - - [20/Oct/2026:20:44:45 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 236
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 20:17:54
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 80.76.49.226 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 80.76.49.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:17:50.121180 2026] [security2:error] [pid 15997:tid 15997] [client 80.76.49.226:51943] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebradleyclinic.com"] [uri "/.env"] [unique_id "atfMbrBjay4eLwAT5EqE2QAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Rom74
2026-10-20 19:55:59
(6 hours ago)
[20/Oct/2026:19:54:35 +0000] - - 301 - GET http teslogiciels.com "/.env" [Client 80.76.49.226] [Leng ...
show more
[20/Oct/2026:19:54:35 +0000] - - 301 - GET http teslogiciels.com "/.env" [Client 80.76.49.226] [Length 166] [Gzip -] [Sent-to 192.168.1.15] "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50" "-"
[20/Oct/2026:19:55:19 +0000] - - 301 - GET https teslogiciels.com "/.env" [Client 80.76.49.226] [Length 166] [Gzip -] [Sent-to 192.168.1.15] "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50" "-"
[20/Oct/2026:19:55:59 +0000] - - 444 - GET https www.teslogiciels.com "/.env" [Client 80.76.49.226] [Length 0] [Gzip -] [Sent-to 192.168.1.15] "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50" "-"
...
show less
Web App Attack
🇳🇴
jad-abuse
2026-10-20 19:28:42
(6 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack
🇳🇱
Alt255
2026-10-20 19:21:19
(6 hours ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 80.76.49.226 - - [20/Oct/2026:21:21:07 +0200] "GET /.env HTTP/1.1" 301 485 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
...
show less
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-04-10 20:44:02
(6 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 80.76.49.226 (US/United States/-): 1 ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 80.76.49.226 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
ipblock.com
2026-01-09 00:25:00
(9 months ago)
IPBlock protected site ID [1365-l].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2025-11-25 17:32:00
(10 months ago)
IPBlock protected site ID [1365-l].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
2025-10-31 15:12:00
(11 months ago)
Unauthorized connection attempt
Brute-Force
🇺🇸
ipblock.com
2025-10-28 23:29:00
(11 months ago)
IPBlock protected site ID [1365-l].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2025-10-28 23:25:00
(11 months ago)
IPBlock protected site ID [1365-l].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
