🇩🇪
4server
2026-06-17 12:10:18
(1 day ago)
[WedJun1714:10:15.4751732026][security2:error][pid2757563:tid2757615][client149.28.255.6:0]ModSecuri ...
show more
[WedJun1714:10:15.4751732026][security2:error][pid2757563:tid2757615][client149.28.255.6:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".db\"][severity\"ERROR\"][hostname\"mail.wildpferde.ch\"][uri\"/one-api.db\"][unique_id\"ajKOp59mPifo32Ffn49bggAAAIY\"]
show less
Port Scan
Brute-Force
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-06-17 08:27:30
(1 day ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-16 23:08:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 19:07:58.699058 2026] [security2:error] [pid 14631:tid 14631] [client 149.28.255.6:48888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.qxoticdivas.postermodelsworldwideinc.com"] [uri "/.env.bak"] [unique_id "ajHXTg4fGULQLtQIAFN7OwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 01:40:49
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 21:40:41.994863 2026] [security2:error] [pid 1512:tid 1512] [client 149.28.255.6:8024] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ilandman.com"] [uri "/.env"] [unique_id "ajCpmYuEHsjAySXPJm9ydQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-16 01:00:56
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 21:00:50.124351 2026] [security2:error] [pid 29016:tid 29016] [client 149.28.255.6:50244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.construction.bonefrog.com"] [uri "/.env.local"] [unique_id "ajCgQoTKBRX0fGxrp0Rx_QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 16:23:06
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com ...
show more
(mod_security) mod_security (id:210492) triggered by 149.28.255.6 (149.28.255.6.vultrusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:22:56.314535 2026] [security2:error] [pid 22128:tid 22140] [client 149.28.255.6:63248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloradomohs.aafm.us"] [uri "/.env.save"] [unique_id "ajAm4NO1f0LFAhtn4utclAAAAIQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-06-15 15:37:44
(3 days ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇬🇧
OptimusGO
2026-06-15 15:11:37
(3 days ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-15 16:11:37 UTC
Log evidence:
149.28.255.6 - - [15/Jun/2026:16:11:36 +0100] "GET / HTTP/1.1" 200 409 "-" "Python/3.13 aiohttp/3.13.1"
06/15/2026-16:11:36.726747 [**] [1:2064326:1] ET INFO Python aiohttp User-Agent Observed Inbound [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 149.28.255.6:40086 -> 185.127.18.66:80
06/15/2026-16:11:36.726747 [**] [1:1000201:1] SCANNER: Bot-like User-Agent Detected [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 149.28.255.6:40086 -> 185.127.18.66:80
show less
Port Scan
Brute-Force
2026-06-14 07:06:10
(4 days ago)
Trying to access config files
Web App Attack
🇮🇱
spd.co.il
2026-06-12 12:01:29
(6 days ago)
Port scan detected on multiple ports
Port Scan
🇬🇷
setupgr
2026-06-11 00:00:32
(1 week ago)
(mod_security) mod_security (id:900001) triggered by 149.28.255.6: 1 in the last 86400 secs; Ports: ...
show more
(mod_security) mod_security (id:900001) triggered by 149.28.255.6: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Jun 11 03:00:30.197696 2026] [security2:error] [pid 1859206:tid 1859404] [client 149.28.255.6:55132] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr|alloweddomain2\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: fashionfragonard.gr"] [severity "CRITICAL"] [tag "security"] [hostname "fashionfragonard.gr"] [uri "/wp-login.php"] [unique_id "ain6nuzFAHSPflP_BRzUNwAAAQc"], referer: https://fashionfragonard.gr/
show less
Port Scan