🇯🇵
SentinalX by uzumaru
2026-06-19 02:40:01
(2 days ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.ipify.org:443
show less
Open Proxy
Port Scan
🇯🇵
SentinalX by uzumaru
2026-06-18 01:44:41
(3 days ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: clients3.google.com:443
show less
Open Proxy
Port Scan
🇺🇸
TPI-Abuse
2026-05-15 23:19:18
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 19:19:14.173388 2026] [security2:error] [pid 29230:tid 29230] [client 155.2.216.4:32941] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "i4agency.com"] [uri "/.env"] [unique_id "agep8gcMly2BTd2E_Bv9xgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
A000Z
2026-05-15 16:08:31
(1 month ago)
Fail2Ban: 155.2.216.4 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Empty/Hidden ...
show more
Fail2Ban: 155.2.216.4 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Empty/Hidden User-Agent
show less
Bad Web Bot
🇨🇳
ThreatBook.io
2026-05-15 00:45:46
(1 month ago)
ThreatBook Intelligence: vpn_proxy more details on http://threatbook.io/ip/155.2.216.4
2026-05-14 23 ...
show more
ThreatBook Intelligence: vpn_proxy more details on http://threatbook.io/ip/155.2.216.4
2026-05-14 23:15:00 /.env
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 10:50:22
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:949110) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:50:07.032864 2026] [security2:error] [pid 7777:tid 7777] [client 155.2.216.4:39909] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "toxicnation.com"] [uri "/.env"] [unique_id "agWo3ybI6x_D-BuISSPDuAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 10:18:07
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 06:18:00.490930 2026] [security2:error] [pid 11246:tid 11246] [client 155.2.216.4:38681] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "redlitephotos.com"] [uri "/.env"] [unique_id "agWhWL97mLD0XqKwnt0LzgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 09:55:29
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 05:55:23.749993 2026] [security2:error] [pid 29997:tid 30020] [client 155.2.216.4:48269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newyorklifecoach.com"] [uri "/.env"] [unique_id "agWcCy3yMQNded-fJxelPgAAARI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-14 03:57:41
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 23:57:37.293421 2026] [security2:error] [pid 32511:tid 32511] [client 155.2.216.4:40607] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "appalachianstomp.com"] [uri "/.env"] [unique_id "agVIMZsfryQb4-jqQK-e7gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-04 04:07:31
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 00:07:25.622349 2026] [security2:error] [pid 24197:tid 24197] [client 155.2.216.4:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uwsvita.org|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uwsvita.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afgbfaRoqKB_S-rladbFGAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Carsten
2026-05-04 04:07:26
(1 month ago)
GET [vendor/phpunit/phpunit/phpunit.xsd]
Port Scan
🇩🇪
FeG Deutschland
2026-05-02 17:45:44
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-02 15:39:39
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 11:39:33.589251 2026] [security2:error] [pid 29228:tid 29228] [client 155.2.216.4:20585] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eurosoni.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eurosoni.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afYatYywnyGMigLfbZlBNgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-02 14:52:12
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 10:52:05.613062 2026] [security2:error] [pid 18378:tid 18378] [client 155.2.216.4:43627] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ineedafriend.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ineedafriend.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afYPlRF-b8j5GvD_w_T2mgAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-02 13:57:21
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.216.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 09:57:17.358409 2026] [security2:error] [pid 12881:tid 12881] [client 155.2.216.4:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ruralcommunitycare.org|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ruralcommunitycare.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afYCva-mD5-vXNPcIQrmkwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack