🇺🇸
TPI-Abuse
2026-05-16 11:19:00
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:18:50.209160 2026] [security2:error] [pid 3598:tid 3598] [client 149.143.135.220:33647] ...
show more
(mod_security) mod_security (id:210730) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:18:50.209160 2026] [security2:error] [pid 3598:tid 3598] [client 149.143.135.220:33647] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nodepotgroup.nodepot.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nodepotgroup.nodepot.com"] [uri "/database.sql"] [unique_id "aghSmvj95UaIq72YsCQtDAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:48:32
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:48:20.995546 2026] [security2:error] [pid 7785:tid 7785] [client 149.143.135.220:59283] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:48:20.995546 2026] [security2:error] [pid 7785:tid 7785] [client 149.143.135.220:59283] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cthog.xyz"] [uri "/.git/config"] [unique_id "agbd1PGiaWpZbHH_RY1NUQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:24:30
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:24:02.169344 2026] [security2:error] [pid 13981:tid 13981] [client 149.143.135.220:3944 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:24:02.169344 2026] [security2:error] [pid 13981:tid 13981] [client 149.143.135.220:39443] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnhansonmemorial.org.coolingsprings.org"] [uri "/.env.docker"] [unique_id "agbYIg5_fJHAADZ1q9jpNwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 07:05:56
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:04:52.996803 2026] [security2:error] [pid 2870:tid 2870] [client 149.143.135.220:36533] ...
show more
(mod_security) mod_security (id:210730) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:04:52.996803 2026] [security2:error] [pid 2870:tid 2870] [client 149.143.135.220:36533] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||galvez.cc|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "galvez.cc"] [uri "/database.sql"] [unique_id "agbFlC0Zn8SqWi-0xi1kYQAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:43:46
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:29.885063 2026] [security2:error] [pid 13058:tid 13058] [client 149.143.135.220:5330 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:42:29.885063 2026] [security2:error] [pid 13058:tid 13058] [client 149.143.135.220:53301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "callahan-co.com"] [uri "/.env~"] [unique_id "agbAVVApYEymQklaerK25AAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:27:22
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:26:43.982264 2026] [security2:error] [pid 12329:tid 12329] [client 149.143.135.220:3339 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:26:43.982264 2026] [security2:error] [pid 12329:tid 12329] [client 149.143.135.220:33397] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.piperwaite.com.bonefrog.com"] [uri "/.env.old"] [unique_id "aga8o42sAF0FJ6G_kyClowAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-05-11 13:13:00
UTC ·
(6 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 149.143.135.220 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇺🇸
TPI-Abuse
2026-05-11 10:57:19
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 06:57:08.377835 2026] [security2:error] [pid 13323:tid 13346] [client 149.143.135.220:5413 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 06:57:08.377835 2026] [security2:error] [pid 13323:tid 13346] [client 149.143.135.220:54131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.realitybytes.us.mailporte.com"] [uri "/.htpasswd"] [unique_id "agG2BO4rvx3benFFlvCfRAAAAJQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-10 09:17:12
UTC ·
(6 months ago)
(caddyscan) Scanner path probe from 149.143.135.220 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.220 - - [10/May/2026:08:45:35 +0000] "GET /.env HTTP/1.1"
...
show more
(caddyscan) Scanner path probe from 149.143.135.220 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.220 - - [10/May/2026:08:45:35 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 149.143.135.220 - - [10/May/2026:08:45:35 +0000] "GET /actuator/heapdump HTTP/1.1"
[REDACTED] 200 2627 149.143.135.220 - - [10/May/2026:08:45:36 +0000] "GET /.env.dist HTTP/1.1"
[REDACTED] 200 2627 149.143.135.220 - - [10/May/2026:08:45:36 +0000] "GET /.env.release HTTP/1.1"
[REDACTED] 200 0 149.143.135.220 - - [10/May/2026:09:17:08 +0000] "HEAD /.git/config HTTP/1.1"
show less
Port Scan
2026-05-09 14:16:57
UTC ·
(6 months ago)
(caddyscan) Scanner path probe from 149.143.135.220 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.220 - - [09/May/2026:14:16:52 +0000] "GET /.git/objects/ H ...
show more
(caddyscan) Scanner path probe from 149.143.135.220 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 149.143.135.220 - - [09/May/2026:14:16:52 +0000] "GET /.git/objects/ HTTP/1.1"
[REDACTED] 200 0 149.143.135.220 - - [09/May/2026:14:16:52 +0000] "HEAD /.env.testing HTTP/1.1"
[REDACTED] 200 0 149.143.135.220 - - [09/May/2026:14:16:53 +0000] "HEAD /.git/config HTTP/1.1"
[REDACTED] 200 2627 149.143.135.220 - - [09/May/2026:14:16:56 +0000] "GET /.env.2 HTTP/1.1"
[REDACTED] 200 2627 149.143.135.220 - - [09/May/2026:14:16:57 +0000] "GET /.env.0 HTTP/1.1"
show less
Port Scan
🇺🇸
wordpresshosting.solutions
2026-05-08 10:54:35
UTC ·
(6 months ago)
Web app vulnerability scanning detected. Evidence: 149.143.135.220 - - [08/May/2026:10:54:33 +0000] "HEAD /.aws/config HTTP/1.1" 404 4129 "https://[DOMAIN]/.aws/config" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ...
show more
Web app vulnerability scanning detected. Evidence: 149.143.135.220 - - [08/May/2026:10:54:33 +0000] "HEAD /.aws/config HTTP/1.1" 404 4129 "https://[DOMAIN]/.aws/config" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
149.143.135.220 - - [08/May/2026:10:54:34 +0000] "HEAD /root/.aws/credentials HTTP/1.1" 404 3321 "https://[DOMAIN]/root/.aws/credentials" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 08:07:00
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 04:06:49.318802 2026] [security2:error] [pid 24077:tid 24077] [client 149.143.135.220:3944 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 04:06:49.318802 2026] [security2:error] [pid 24077:tid 24077] [client 149.143.135.220:39445] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haywardcarpentry.com"] [uri "/.env.test"] [unique_id "afr2mfHDcJxfFmMIpz3glQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-05 11:36:54
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:36:00.457476 2026] [security2:error] [pid 10200:tid 10251] [client 149.143.135.220:5317 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:36:00.457476 2026] [security2:error] [pid 10200:tid 10251] [client 149.143.135.220:53179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uoexpanse.com"] [uri "/.env.staging.local"] [unique_id "afnWIMhS_DIVHt4wdsAD1gAAAMU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
conrad10781
2026-05-05 04:00:34
UTC ·
(6 months ago)
nginx-dot-env
Web App Attack
🇺🇸
TPI-Abuse
2026-05-04 22:55:57
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 18:55:49.597461 2026] [security2:error] [pid 28019:tid 28019] [client 149.143.135.220:5762 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 18:55:49.597461 2026] [security2:error] [pid 28019:tid 28019] [client 149.143.135.220:57621] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.shirleyconcrete.com"] [uri "/.env~"] [unique_id "afkj9SSoCY1QKfs8Hsx5gwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack