🇳🇱
Site.eu
2026-11-10 10:27:37
UTC ·
(5 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇸🇬
spydithreatintel
2026-11-05 21:24:55
UTC ·
(1 week ago)
Web honeypot: 28 HTTP request(s) incl. path-enumeration, secret-probe. Example: GET /.env.staging
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-10-30 04:11:36
UTC ·
(2 weeks ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /[a-z0-9]{1,12}\.php (Match: /mail.php)
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 18:26:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:26:00.558303 2026] [security2:error] [pid 4548:tid 4548] [client 91.219.212.11:45443] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:26:00.558303 2026] [security2:error] [pid 4548:tid 4548] [client 91.219.212.11:45443] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mavrik12.com"] [uri "/platform/.env"] [unique_id "auDsuHzbGw0_-uQErDwXWgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-22 03:05:38
UTC ·
(3 weeks ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 09:00:21
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 04:59:50.111987 2026] [security2:error] [pid 20702:tid 20702] [client 91.219.212.11:64907] M ...
show more
(mod_security) mod_security (id:210730) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 04:59:50.111987 2026] [security2:error] [pid 20702:tid 20702] [client 91.219.212.11:64907] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||threewild.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "threewild.com"] [uri "/config/mail.php.old"] [unique_id "ath_BhK3T4UNGibYp4coTAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 06:08:26
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 02:08:20.140222 2026] [security2:error] [pid 31693:tid 31693] [client 91.219.212.11:51700] M ...
show more
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 02:08:20.140222 2026] [security2:error] [pid 31693:tid 31693] [client 91.219.212.11:51700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.hg/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jasconius.org"] [uri "/.hg/requires"] [unique_id "athW1P7iGdtiBEb-YK2WKwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-20 11:07:19
UTC ·
(3 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 03:34:10
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 23:34:00.237946 2026] [security2:error] [pid 30230:tid 30230] [client 91.219.212.11:13046] M ...
show more
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 23:34:00.237946 2026] [security2:error] [pid 30230:tid 30230] [client 91.219.212.11:13046] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "4give-n-hearts.org"] [uri "/wp-config.php-backup"] [unique_id "atbhKBYoOh7liuSxktWSnAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 01:43:26
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 21:43:18.845237 2026] [security2:error] [pid 13427:tid 13440] [client 91.219.212.11:26088] M ...
show more
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 21:43:18.845237 2026] [security2:error] [pid 13427:tid 13440] [client 91.219.212.11:26088] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ainavelas.com"] [uri "/sites/all/libraries/mailchimp/.env"] [unique_id "atV1tv77QDPiy6j4rlxCegAAAUo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-10-18 12:08:45
UTC ·
(4 weeks ago)
Blocked by Conn-Monitor: env-probing
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-10-17 21:59:34
UTC ·
(4 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-16.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-17 08:05:55
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 04:05:35.648630 2026] [security2:error] [pid 26900:tid 26900] [client 91.219.212.11:57553] M ...
show more
(mod_security) mod_security (id:210492) triggered by 91.219.212.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 04:05:35.648630 2026] [security2:error] [pid 26900:tid 26900] [client 91.219.212.11:57553] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrismonty.com"] [uri "/test/.env"] [unique_id "atMsT2HTMEMnili5A7GfCQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-07-24 00:00:08
UTC ·
(1 year ago)
Detected attack by Imunify360
Brute-Force
Web App Attack
🇩🇪
conseilgouz
2025-07-04 15:32:22
UTC ·
(1 year ago)
lae-12 : Block return, carriage return, ... characters=>/component/weblinks/weblink/11-la-perle-des-crepes?Itemid=135&Itemid=%27&catid=19&task=w...(')
Hacking
