🇺🇸
TPI-Abuse
2026-10-19 23:38:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 19:38:02.560311 2026] [security2:error] [pid 9202:tid 9202] [client 89.46.109.241:22530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alianzallc.com"] [uri "/.env"] [unique_id "atap2gOtHMeTCs2PKZLirQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 20:10:36
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 16:10:31.928133 2026] [security2:error] [pid 2025:tid 2025] [client 89.46.109.241:26208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lyldevelopers.com"] [uri "/.env"] [unique_id "atZ5N9dnd94fBJrWXGnP5gAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-19 19:35:12
(1 day ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 14:08:47
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 10:08:42.480280 2026] [security2:error] [pid 18920:tid 18920] [client 89.46.109.241:28106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icro.net"] [uri "/.env"] [unique_id "atYkanfnp8BEkPhBXJPntwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 12:33:08
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 08:33:05.066389 2026] [security2:error] [pid 27914:tid 27914] [client 89.46.109.241:32604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mousseron.com"] [uri "/.env"] [unique_id "atYOAcgkb0WDcTOAFAaP0gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 08:20:33
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 04:20:29.600162 2026] [security2:error] [pid 7635:tid 7635] [client 89.46.109.241:41726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thediscounttoolbox.com"] [uri "/.env"] [unique_id "atXSzU569JQ5MGqVY8r_rwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Lee Daniel
2026-10-19 05:43:27
(2 days ago)
89.46.109.241 - - [19/Oct/2026:01:43:26 -0400] "GET /.env HTTP/1.1" 403 6279 "-" "-"
...
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 05:29:44
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 01:29:36.549898 2026] [security2:error] [pid 23251:tid 23251] [client 89.46.109.241:40324] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cheynans.com"] [uri "/.env"] [unique_id "atWqwGX6DEBI3vVXffpt0wAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 04:56:17
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 00:56:13.564574 2026] [security2:error] [pid 2310:tid 2310] [client 89.46.109.241:33960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "partyinvitationsprinted.com"] [uri "/.env"] [unique_id "atWi7aKDEyotNLj-G2UU4QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 03:33:27
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 23:33:22.665912 2026] [security2:error] [pid 20495:tid 20495] [client 89.46.109.241:20584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bonesband.com"] [uri "/.env"] [unique_id "atWPgnt7esIjKwxB2Y2b0wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 10:37:29
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 06:37:23.208508 2026] [security2:error] [pid 26988:tid 26988] [client 89.46.109.241:28158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fxztrader.com"] [uri "/.env"] [unique_id "arZO41kWpVt-iqNQWzzsVgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 06:22:38
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 02:22:31.288252 2026] [security2:error] [pid 26727:tid 26775] [client 89.46.109.241:42624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "managementconsultant.us"] [uri "/.env"] [unique_id "arYTJzFVnhJuxnijOua6TAAAAMs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-09-22 23:10:21
(4 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-22 21:41:37
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 17:41:34.140592 2026] [security2:error] [pid 18047:tid 18047] [client 89.46.109.241:21284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "christmascardsprinted.com"] [uri "/wp-config.php.bak"] [unique_id "arL2DgDSSkBQ5RJvpY3ZHgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 21:14:04
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati ...
show more
(mod_security) mod_security (id:210492) triggered by 89.46.109.241 (host241-109-46-89.serverdedicati.aruba.it): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 17:13:58.568873 2026] [security2:error] [pid 6540:tid 6540] [client 89.46.109.241:37372] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paragontechusa.com"] [uri "/wp-config.php.bak"] [unique_id "arLvlngCZN3BC5dnmNoMHgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
