2026-02-13 16:31:14
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
TPI-Abuse
2026-02-13 13:41:11
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 08:41:04.278116 2026] [security2:error] [pid 26656:tid 26656] [client 104.207.32.4:12769] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindbodyrestored.com"] [uri "/.env.production"] [unique_id "aY8p8NTexcX5A1wmeoab7AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 05:14:36
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 00:14:30.164903 2026] [security2:error] [pid 17037:tid 17037] [client 104.207.32.4:14445] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "matrixpercussiontrio.com"] [uri "/.env.local"] [unique_id "aY6zNlsOQ5ejmqpMcXkUfgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
jjnxpct
2026-02-13 04:48:24
(3 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.git/config (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .git/ found within REQUEST_FILENAME: /.git/config]
show less
Hacking
Web App Attack
🇫🇷
dynamix
2026-02-13 04:13:32
(3 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 03:45:29
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 22:45:25.339364 2026] [security2:error] [pid 2196829:tid 2196829] [client 104.207.32.4:39911] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "maritanasystems.com"] [uri "/config/.env"] [unique_id "aY6eVTPNHWpOofdTymv77AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 02:43:44
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 21:43:41.521759 2026] [security2:error] [pid 30452:tid 30452] [client 104.207.32.4:18705] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mangamaster.org"] [uri "/.env.local"] [unique_id "aY6P3QTq1wxejIk0-8fFiAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 01:50:10
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 20:50:05.991454 2026] [security2:error] [pid 2227255:tid 2227255] [client 104.207.32.4:44563] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mairslair.com"] [uri "/backend/.env"] [unique_id "aY6DTRSeq-ySBD37EwFsJAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-13 01:13:55
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 20:13:52.029014 2026] [security2:error] [pid 1349544:tid 1349562] [client 104.207.32.4:46189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "magazineofwallstreet.com"] [uri "/admin/.env"] [unique_id "aY560LshNVWq7jtWtWmrCgAAAg8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-12 19:49:38
(3 months ago)
104.207.32.4 - - [12/Feb/2026:19:49:36 +0000] "GET /.git/config HTTP/1.1" 302 3408 "-" "Mozilla/5.0 ...
show more
104.207.32.4 - - [12/Feb/2026:19:49:36 +0000] "GET /.git/config HTTP/1.1" 302 3408 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-02-12 16:09:50
(3 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.32.4 (US/United States/-): ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.32.4 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇪🇸
10dencehispahard SL
2026-01-26 07:21:36
(4 months ago)
Wordpress probing for vulnerabilities
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2025-12-02 23:04:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 18:04:01.360215 2025] [security2:error] [pid 23989:tid 23989] [client 104.207.32.4:44015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chitsey.com"] [uri "/.git/HEAD"] [unique_id "aS9wYe3aJpFya7EOHYgpzQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 08:20:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 03:20:32.204147 2025] [security2:error] [pid 19613:tid 19613] [client 104.207.32.4:55487] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thegamblefamily.com"] [uri "/.svn/wc.db"] [unique_id "aS6hUH2FkgdkkqqG2GHvPwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 07:45:31
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 02:45:26.207771 2025] [security2:error] [pid 26691:tid 26691] [client 104.207.32.4:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barryherbach.com"] [uri "/.env"] [unique_id "aS6ZFtlBax4ShWn4XZaxwgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack