🇳🇱
homeshowdomain.nl
2026-09-26 22:01:03
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-25.
show less
Web App Attack
SSH
Hacking
🇳🇱
Alt255
2026-09-25 09:45:37
(3 weeks ago)
[ti-hoogstraov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Exampl ...
show more
[ti-hoogstraov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 86.107.37.72 - - \[25/Sep/2026:11:45:19 +0200\] "GET /.env HTTP/1.1" 301 541 "-" "-"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 07:28:39
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 03:28:32.393980 2026] [security2:error] [pid 238831:tid 238831] [client 86.107.37.72:55770] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teamrealduck.com"] [uri "/.env"] [unique_id "arYioAGbFxokbuicvBtRAAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Lee Daniel
2026-09-25 06:00:28
(3 weeks ago)
86.107.37.72 - - [25/Sep/2026:02:00:27 -0400] "GET /.env HTTP/1.1" 403 344 "-" "-"
...
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-09-23 12:13:50
(3 weeks ago)
csagent: score 20.2: wp-config backup grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 23:59:23
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 19:59:19.214260 2026] [security2:error] [pid 20414:tid 20414] [client 86.107.37.72:59334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wolter-hausser.com"] [uri "/wp-config.php.bak"] [unique_id "arMWV8dc4pNSWYbtSaa7nAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 20:41:15
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:41:09.147254 2026] [security2:error] [pid 12615:tid 12615] [client 86.107.37.72:34996] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greatwesternfirearms.com"] [uri "/wp-config.php.bak"] [unique_id "arLn5RWaqzcgizGuk4R2ewAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:46:50
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:46:45.004255 2026] [security2:error] [pid 1849:tid 1849] [client 86.107.37.72:43194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sharkfamily.com"] [uri "/wp-config.php.bak"] [unique_id "arLbJaE_-fWfyrsrIU17dAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 19:27:29
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:27:21.668440 2026] [security2:error] [pid 21338:tid 21338] [client 86.107.37.72:36604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelmoorefield.com"] [uri "/wp-config.php.bak"] [unique_id "arLWmTuaLGFbQiIMjObfCwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:52:05
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:51:59.180443 2026] [security2:error] [pid 14289:tid 14328] [client 86.107.37.72:55556] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alzooma.com"] [uri "/wp-config.php.bak"] [unique_id "arLOTyfb_q-L5erfWJ-58AAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:15:48
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:15:41.685253 2026] [security2:error] [pid 16019:tid 16019] [client 86.107.37.72:49638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pilotchristmascards.com"] [uri "/wp-config.php.bak"] [unique_id "arLFzf4rG3ookW3ensyyGAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-22 17:25:46
(3 weeks ago)
This address is looking for secret files on our sites: .git directories, .env files, credential and ...
show more
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /wp-config.php.bak | 2026-09-22 17:25 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 17:11:23
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 13:11:19.273821 2026] [security2:error] [pid 5501:tid 5501] [client 86.107.37.72:40644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "itony.com"] [uri "/wp-config.php.bak"] [unique_id "arK2t46-wMH62zCs1UUO1AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:53:20
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:53:17.430671 2026] [security2:error] [pid 20328:tid 20328] [client 86.107.37.72:51442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nexxosrealty.com"] [uri "/wp-config.php.bak"] [unique_id "arKkbRzDQEyE-7Usnpd2bwAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:34:39
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last ...
show more
(mod_security) mod_security (id:210492) triggered by 86.107.37.72 (bodhi.dnshigh.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:34:33.627660 2026] [security2:error] [pid 16575:tid 16575] [client 86.107.37.72:43356] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jpastorphotographics.com"] [uri "/wp-config.php.bak"] [unique_id "arKR-axI-OqX4th8lQOe-gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
