🇺🇸
TPI-Abuse
2026-05-23 23:37:01
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 19:36:54.509810 2026] [security2:error] [pid 25635:tid 25635] [client 149.143.137.44:58417] ...
show more
(mod_security) mod_security (id:210730) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 19:36:54.509810 2026] [security2:error] [pid 25635:tid 25635] [client 149.143.137.44:58417] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cnwire.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cnwire.com"] [uri "/database.sql"] [unique_id "ahI6Fjw3YEnE1ncdG1MKbgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-20 20:53:05
UTC ·
(5 months ago)
(caddyscan) Scanner path probe from 149.143.137.44 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /.aws/config HTTP/1. ...
show more
(caddyscan) Scanner path probe from 149.143.137.44 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /.aws/config HTTP/1.1"
[REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /backend/.env HTTP/1.1"
[REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /.git/config HTTP/1.1"
[REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /app/.env HTTP/1.1"
[REDACTED] 200 0 149.143.137.44 - - [20/May/2026:20:53:03 +0000] "HEAD /api/.env HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-20 13:44:47
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 09:44:30.831045 2026] [security2:error] [pid 9911:tid 9911] [client 149.143.137.44:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 09:44:30.831045 2026] [security2:error] [pid 9911:tid 9911] [client 149.143.137.44:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env.dist"] [unique_id "ag26vt5Fq7t7XzCeEEC4rwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-17 04:10:48
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 00:10:41.723723 2026] [security2:error] [pid 13888:tid 13888] [client 149.143.137.44:50977] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 00:10:41.723723 2026] [security2:error] [pid 13888:tid 13888] [client 149.143.137.44:50977] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.michaelwakim.teamwakimphotography.com"] [uri "/.git/config"] [unique_id "agk_wZ8sY3ve5lxQYb3t1gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-16 11:11:55
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:11:51.295285 2026] [security2:error] [pid 27532:tid 27532] [client 149.143.137.44:54519] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 07:11:51.295285 2026] [security2:error] [pid 27532:tid 27532] [client 149.143.137.44:54519] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kikisfriends.truefauxstudio.com"] [uri "/.env.backup"] [unique_id "aghQ9zjhlBn2KdpZZ3RbrwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 09:03:35
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 05:03:06.781827 2026] [security2:error] [pid 19651:tid 19651] [client 149.143.137.44:47297] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 05:03:06.781827 2026] [security2:error] [pid 19651:tid 19651] [client 149.143.137.44:47297] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crearetest.com"] [uri "/.env.production"] [unique_id "agbhSrRS0Ls6lpMoy8wkfwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:35:47
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:35:25.114161 2026] [security2:error] [pid 16516:tid 16516] [client 149.143.137.44:37147] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:35:25.114161 2026] [security2:error] [pid 16516:tid 16516] [client 149.143.137.44:37147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vccemail.net"] [uri "/.env.test"] [unique_id "agbazbjTDyyM4VTl2AIRKwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:03:59
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:03:17.495122 2026] [security2:error] [pid 9875:tid 9875] [client 149.143.137.44:36627] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:03:17.495122 2026] [security2:error] [pid 9875:tid 9875] [client 149.143.137.44:36627] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazinghydraulics.com"] [uri "/.env.demo"] [unique_id "agbTReKOa79isUO_QIndOQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:20:21
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:18:56.078171 2026] [security2:error] [pid 26198:tid 26198] [client 149.143.137.44:37347] ...
show more
(mod_security) mod_security (id:210730) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:18:56.078171 2026] [security2:error] [pid 26198:tid 26198] [client 149.143.137.44:37347] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blanchebb.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blanchebb.com"] [uri "/dump.sql"] [unique_id "aga60MFRa124ImPnH-bQowAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 10:54:39
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:54:25.578116 2026] [security2:error] [pid 14516:tid 14516] [client 149.143.137.44:36613] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:54:25.578116 2026] [security2:error] [pid 14516:tid 14516] [client 149.143.137.44:36613] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jikishin-kai.org"] [uri "/.env~"] [unique_id "agWp4b3DO52dn3Q9-gBppwAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 13:53:10
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:18.590292 2026] [security2:error] [pid 19281:tid 19281] [client 149.143.137.44:59325] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 09:52:18.590292 2026] [security2:error] [pid 19281:tid 19281] [client 149.143.137.44:59325] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "peanutcarvings.com"] [uri "/api/.env"] [unique_id "agMwkjW7MZc_x7BPkIezeQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-11 00:29:20
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 20:29:05.203722 2026] [security2:error] [pid 8081:tid 8081] [client 149.143.137.44:45169] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 20:29:05.203722 2026] [security2:error] [pid 8081:tid 8081] [client 149.143.137.44:45169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bronislawsuchanek.com"] [uri "/.env.backup"] [unique_id "agEi0W795zgzqgJyhMcl4wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 11:26:55
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 07:26:35.915193 2026] [security2:error] [pid 28084:tid 28084] [client 149.143.137.44:47671] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 07:26:35.915193 2026] [security2:error] [pid 28084:tid 28084] [client 149.143.137.44:47671] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.albertmassaad.com.easternimport.com"] [uri "/.env.vault"] [unique_id "af8Z6_ffeS5b0rLqjQY8MQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 19:21:29
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 15:20:49.995425 2026] [security2:error] [pid 26335:tid 26335] [client 149.143.137.44:59137] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.137.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 15:20:49.995425 2026] [security2:error] [pid 26335:tid 26335] [client 149.143.137.44:59137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ficklepassionproductions.com"] [uri "/.git/config"] [unique_id "af43kZVtAPxrgOvNnKAj3wAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
infra-monitor
2026-05-07 20:00:05
UTC ·
(6 months ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan