🇩🇪
rh24
2026-05-30 11:29:41
(1 week ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 104.238.37.158 (US/U ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 104.238.37.158 (US/United States/-)
show less
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-05-28 22:00:25
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-27.
show less
Web App Attack
SSH
Hacking
🇩🇪
big-cloud.nl
2026-05-27 22:58:00
(1 week ago)
Try to access /.aws/credentials
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 17:44:23
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 13:44:09.502135 2026] [security2:error] [pid 6290:tid 6290] [client 104.238.37.158:60601] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bryteandbroderick.org"] [uri "/app/config/parameters.yml"] [unique_id "ahctaR_f2APWnJNeaY_uNgAAAAA"], referer: https://www.google.com/search?q=bryteandbroderick.org
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:57:20
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:56:56.512307 2026] [security2:error] [pid 15555:tid 15555] [client 104.238.37.158:60647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pittyvaich.com"] [uri "/app/config/parameters.yml"] [unique_id "ahZBWBmaRhan62iavOaQHwAAABA"], referer: https://www.google.com/search?q=pittyvaich.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:41:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:41:10.126397 2026] [security2:error] [pid 3264:tid 3280] [client 104.238.37.158:51925] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "boatservices.boatservicesgroup.com"] [uri "/wp-config.php.save"] [unique_id "ahY9plcsN55sDwxUW5BrXgAAAU0"], referer: https://www.google.com/search?q=boatservices.boatservicesgroup.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:13:13
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:13:07.789805 2026] [security2:error] [pid 29882:tid 29882] [client 104.238.37.158:59213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "boardingatthewedge.com"] [uri "/wp-config.php.swp"] [unique_id "ahY3E-lT_YnCqmTIOUOeygAAACw"], referer: https://www.google.com/search?q=boardingatthewedge.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 23:54:31
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.238.37.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 19:54:26.244907 2026] [security2:error] [pid 22599:tid 22599] [client 104.238.37.158:35711] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.comunitatregantsangles.cat.zentinex.com"] [uri "/.env.backup"] [unique_id "ahYysg8ncKKlcGrwikt4pgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-26 21:59:49
(1 week ago)
Auto-ban: >3000 req/min op 2026-05-26
Web App Attack
SSH
Hacking
🇨🇭
4server
2026-05-26 17:02:52
(1 week ago)
[TueMay2619:02:46.2768952026][security2:error][pid2813126:tid2813920][client104.238.37.158:0]ModSecu ...
show more
[TueMay2619:02:46.2768952026][security2:error][pid2813126:tid2813920][client104.238.37.158:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.executivekotech.it.81-17-25-250.cpanel.site\"][uri\"/wp-config.php.save\"][unique_id\"ahXSNi4hYjA91fUFNxVZTgAAAJA\"]\,referer:https://www.google.com/search\?q=www.executivekotech.it.81-17-25-250.cpanel.site
show less
Hacking
Web App Attack
🇦🇺
afleventoffice.com.au
2026-05-26 15:00:20
(1 week ago)
GET /app/config/parameters.yml HTTP/1.1
Web App Attack
🇳🇱
exxos
2025-09-09 19:03:01
(8 months ago)
Attacks with Bad user agents
Hacking