🇩🇪
Bedios GmbH
2026-09-25 11:55:17
(10 hours ago)
Login credentials theft attempt
Hacking
🇳🇱
Alt255
2026-09-25 10:46:23
(12 hours ago)
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89 ...
show more
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89.46.109.232 - - \[25/Sep/2026:12:46:11 +0200\] "GET /.env HTTP/1.1" 301 547 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 05:45:09
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 01:45:04.925050 2026] [security2:error] [pid 15345:tid 15345] [client 89.46.109.232:45468] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "portalvasco.com"] [uri "/radaresfijos/.env"] [unique_id "arYKYNvHo-5henRD8n0fQAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 04:52:35
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 00:52:30.308013 2026] [security2:error] [pid 31850:tid 31853] [client 89.46.109.232:46504] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "leadingedgesupply.com"] [uri "/.env"] [unique_id "arX-Dl-rXpmZZWgWljkJ2QAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
✨
2026-09-23 00:21:13
(2 days ago)
Domain : leesmunday.com
Rule : hack
2026-09-23 00:18:21 W3SVC301 PLESK76 217.194.212.123 GET /wp-con ...
show more
Domain : leesmunday.com
Rule : hack
2026-09-23 00:18:21 W3SVC301 PLESK76 217.194.212.123 GET /wp-config.php.bak - 80 - 89.46.109.232 HTTP/1.1 - - - leesmunday.com 404 0 0 7605 70 148 - -
show less
Hacking
SQL Injection
Brute-Force
🇺🇸
TPI-Abuse
2026-09-22 22:22:35
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 18:22:30.263166 2026] [security2:error] [pid 25339:tid 25339] [client 89.46.109.232:33462] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "inverzona.com"] [uri "/wp-config.php.bak"] [unique_id "arL_pixzRCNpbJNl7PLHTwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:07:33
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:07:27.368823 2026] [security2:error] [pid 16965:tid 16965] [client 89.46.109.232:24068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "333w88.com"] [uri "/wp-config.php.bak"] [unique_id "arLD3-SJTx_mbUcmmi72NQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:51:43
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:51:40.077395 2026] [security2:error] [pid 6707:tid 6707] [client 89.46.109.232:45990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dansplans.com"] [uri "/wp-config.php.bak"] [unique_id "arLALO5g1MCuD2RTufuZPQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
joharikop
2026-09-22 17:34:15
(3 days ago)
Nginx: credential/secret file probe (/.env, /.git, /.aws etc). Automated ban via fail2ban nginx-cred ...
show more
Nginx: credential/secret file probe (/.env, /.git, /.aws etc). Automated ban via fail2ban nginx-credential-probes jail.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:25:56
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:25:50.356006 2026] [security2:error] [pid 23859:tid 23859] [client 89.46.109.232:38772] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rahmanou.com"] [uri "/wp-config.php.bak"] [unique_id "arK6Hjri50SlrM_xh4mj2gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 12:37:05
(3 days ago)
89.46.109.232 - - [22/Sep/2026:20:37:05 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 250 "-" "-"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 04:34:09
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 00:34:02.532254 2026] [security2:error] [pid 16288:tid 16288] [client 89.46.109.232:36484] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blairsmasterplan.com"] [uri "/.env"] [unique_id "arIFOsKhSRHeAMePNqU6aQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 03:36:20
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 23:36:15.949322 2026] [security2:error] [pid 12325:tid 12325] [client 89.46.109.232:38320] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pearson-specter.com"] [uri "/.env"] [unique_id "arH3r6WaJ-9EGF2Xq_zzWwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 02:09:53
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 22:09:46.876909 2026] [security2:error] [pid 12864:tid 12879] [client 89.46.109.232:42470] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeffgolden.com"] [uri "/.env"] [unique_id "arHjakJSZk4MuqPJo2mQmQAAAcE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:54:20
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.232 (host232-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:54:14.240590 2026] [security2:error] [pid 30371:tid 30371] [client 89.46.109.232:24602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "phoenixchicagorealty.com"] [uri "/.env"] [unique_id "arHfxiD6Vzeyru7_os3dLQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
