🇺🇸
TPI-Abuse
2026-10-22 15:16:42
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 11:16:35.899450 2026] [security2:error] [pid 2824:tid 2824] [client 158.173.36.134:25441] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thanksgivingcardsprinted.com"] [uri "/.env"] [unique_id "atoo0zwHgdYsfDWXfcxYhgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 14:26:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:26:42.382750 2026] [security2:error] [pid 27627:tid 27627] [client 158.173.36.134:64743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "more-grace.com"] [uri "/.env"] [unique_id "atodIrmkNAUM-eq3Rjy6bwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 12:48:45
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 08:48:41.222369 2026] [security2:error] [pid 32761:tid 32761] [client 158.173.36.134:53937] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.assheton.com"] [uri "/.env"] [unique_id "atoGKd_3YIi1gd20lerY0gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 11:53:05
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:52:59.571415 2026] [security2:error] [pid 15238:tid 15238] [client 158.173.36.134:26341] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tarakanov.com"] [uri "/.env"] [unique_id "atn5G97kOXb9s1CuNhBnYgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 09:33:34
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 05:33:28.329861 2026] [security2:error] [pid 19535:tid 19660] [client 158.173.36.134:30597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chilltech.info"] [uri "/.env"] [unique_id "atnYaDhFo8w4a59km2jzEAAAAdI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 09:15:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 05:15:06.288449 2026] [security2:error] [pid 15839:tid 15839] [client 158.173.36.134:62265] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myndsong.com"] [uri "/.env"] [unique_id "atnUGmXauKNJ6NnosuQ7mwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 04:40:57
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:40:49.858452 2026] [security2:error] [pid 14955:tid 14955] [client 158.173.36.134:52671] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "articulaterecords.com"] [uri "/.env"] [unique_id "atmT0TOh_OrsxetSP6f26AAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-19 11:45:33
(4 days ago)
Web probing (6 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CR ...
show more
Web probing (6 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
show less
Web App Attack
2026-10-18 20:54:58
(4 days ago)
apache vulnerability scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 19:21:44
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 15:21:42.681735 2026] [security2:error] [pid 8759:tid 8759] [client 158.173.36.134:38143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lmffl.com"] [uri "/.env"] [unique_id "asvhxvs5saSRu3BtS0htcQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 18:09:45
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:09:40.146530 2026] [security2:error] [pid 18397:tid 18397] [client 158.173.36.134:55757] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "centuryabsinthe.com"] [uri "/.env"] [unique_id "asvQ5L4rhoYOnHC_gZ2ALgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 17:48:22
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 13:48:15.814380 2026] [security2:error] [pid 13681:tid 13681] [client 158.173.36.134:34911] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "n4fh.com"] [uri "/.env"] [unique_id "asvL39spM5hEtqYM-3HNswAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-10-03 23:17:18
(2 weeks ago)
158.173.36.134 - [04/Oct/2026:02:16:29 +0300] "POST /wp-login.php HTTP/1.1" 301 178 "http://www.kyta ...
show more
158.173.36.134 - [04/Oct/2026:02:16:29 +0300] "POST /wp-login.php HTTP/1.1" 301 178 "http://www.kytaja.fi/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36" "-"
158.173.36.134 - [04/Oct/2026:02:16:42 +0300] "POST /wp-login.php HTTP/1.1" 301 178 "http://www.kytaja.fi/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15" "-"
158.173.36.134 - [04/Oct/2026:02:16:54 +0300] "POST /wp-login.php HTTP/1.1" 301 178 "http://www.kytaja.fi/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36" "-"
158.173.36.134 - [04/Oct/2026:02:17:06 +0300] "POST /wp-login.php HTTP/1.1" 301 178 "http://www.kytaja.fi/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.130 Safari/537.36" "-"
158.173.36.134 - [04/Oct/2026:02:17:17 +0300] "
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 05:54:11
(3 weeks ago)
(mod_security) mod_security (id:221260) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:221260) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:54:02.402724 2026] [security2:error] [pid 96961:tid 96961] [client 158.173.36.134:29939] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "80"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||www.oliverhardy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.oliverhardy.com"] [uri "/cgi-bin/status"] [unique_id "ar9G-jVTDTZeZErE5ilVZgAAAAw"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 05:07:38
(3 weeks ago)
(mod_security) mod_security (id:217200) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:217200) triggered by 158.173.36.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:07:33.688773 2026] [security2:error] [pid 3332:tid 3413] [client 158.173.36.134:22507] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||www.internationalboardofstandards.com|F|2"] [data "/guest_auth/guestisup.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.internationalboardofstandards.com"] [uri "/guest_auth/guestIsUp.php"] [unique_id "ar88FcmfNQJe0Cte3nUDAgAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack