🇺🇸
TPI-Abuse
2026-09-25 05:29:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 01:29:33.582307 2026] [security2:error] [pid 13815:tid 13815] [client 89.46.106.169:24362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "navigateworklife.org"] [uri "/.env"] [unique_id "arYGvS8yVdFWqAH_iCnaowAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-25 05:10:01
(1 week ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 89.46.106.169 - - [25/Sep/2026:07:09:56 +0200] "GET /.env HTTP/1.1" 301 433 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-09-22 20:14:50
(1 week ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /wp-config\.php (Match: /wp-config.php)
show less
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 20:10:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:10:09.451804 2026] [security2:error] [pid 21879:tid 21879] [client 89.46.106.169:39154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rachel-heiko.com"] [uri "/wp-config.php.bak"] [unique_id "arLgoZ2kLxfaS9RTYuUOxgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:27:56
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:27:48.738282 2026] [security2:error] [pid 5194:tid 5194] [client 89.46.106.169:40956] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "20dekopas.com"] [uri "/wp-config.php.bak"] [unique_id "arLWtM1sQaZ41laddfU-mAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:06:12
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:06:09.082786 2026] [security2:error] [pid 10600:tid 10600] [client 89.46.106.169:47650] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bonefrog.com"] [uri "/wp-config.php.bak"] [unique_id "arLRofAOv-7njUr1AhA-RAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:37:55
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:37:49.802299 2026] [security2:error] [pid 14551:tid 14551] [client 89.46.106.169:24244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.greatchristianadventure.com"] [uri "/wp-config.php.bak"] [unique_id "arKgzUhxm7HRZNMoEesOTQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:23:26
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:23:21.024469 2026] [security2:error] [pid 19101:tid 19101] [client 89.46.106.169:44982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greensealusa.com"] [uri "/wp-config.php.bak"] [unique_id "arKPWRIfPWZiPrzIX4zpHQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:49:25
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:49:17.285943 2026] [security2:error] [pid 8237:tid 8237] [client 89.46.106.169:25760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "opennatura.com"] [uri "/wp-config.php.bak"] [unique_id "arKHXeGMk3QnpUtJmDIkzgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 12:46:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:46:08.076316 2026] [security2:error] [pid 26008:tid 26008] [client 89.46.106.169:29684] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrisrest.com"] [uri "/wp-config.php.bak"] [unique_id "arJ4kOgLOAUz8ak7602r9QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 03:52:45
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 23:52:41.077747 2026] [security2:error] [pid 29923:tid 29955] [client 89.46.106.169:35048] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hnssales.com"] [uri "/.env"] [unique_id "arH7iV3KBJmvVJUoBumijgAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 03:26:35
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 23:26:29.939090 2026] [security2:error] [pid 13692:tid 13692] [client 89.46.106.169:24022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "backyardbrickoven.com"] [uri "/.env"] [unique_id "arH1Zddi33NpGaOg-fEc8AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 02:31:09
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 22:31:02.465841 2026] [security2:error] [pid 20297:tid 20297] [client 89.46.106.169:41044] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "radixtx.com"] [uri "/.env"] [unique_id "arHoZl_S-X7EXhi3m2wFWAAAAGA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 02:04:08
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.106.169 (host169-106-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 22:04:03.823075 2026] [security2:error] [pid 1084:tid 1084] [client 89.46.106.169:21170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americannetsecurity.com"] [uri "/.env"] [unique_id "arHiE5u6vAbWXvpe2X5tJgAAAGM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-02-27 02:44:00
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
