🇺🇸
TPI-Abuse
2026-10-16 03:59:11
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 23:59:07.049160 2026] [security2:error] [pid 25553:tid 25609] [client 162.158.122.128:14005] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "creativefamily.net"] [uri "/.env.dev"] [unique_id "atGhCxdmqpzCxFVxAAtyxAAAAQ8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 21:10:20
(18 hours ago)
(mod_security) mod_security (id:210730) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 17:10:12.576243 2026] [security2:error] [pid 28011:tid 28011] [client 162.158.122.128:12000] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||prayers4america.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "prayers4america.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "atFBNO3gQn2y8vMZxnEnYQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 16:21:16
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 12:21:08.321146 2026] [security2:error] [pid 1109:tid 1109] [client 162.158.122.128:13667] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "extreme-atv.com"] [uri "/.htaccess"] [unique_id "atD9dPsXndDZDbFcRtiScgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-10-15 15:37:53
(23 hours ago)
HTTP vulnerability scanning
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 11:42:45
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:42:33.470512 2026] [security2:error] [pid 24247:tid 24247] [client 162.158.122.128:12497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gemexpressions.com"] [uri "/.git/config"] [unique_id "atC8Kc4HmXNLNUQwr2mucQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 11:09:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:09:02.848565 2026] [security2:error] [pid 16116:tid 16116] [client 162.158.122.128:13010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rayeliotschwartz.com"] [uri "/.env"] [unique_id "atC0Tkx2jpZD16Hjd2PbegAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:40:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:40:28.705258 2026] [security2:error] [pid 28086:tid 28086] [client 162.158.122.128:9811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "meridianranchdrc.org"] [uri "/.env.local"] [unique_id "atCtnIJQrA4NVBHV08_GhgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:18:08
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:17:56.603759 2026] [security2:error] [pid 7457:tid 7457] [client 162.158.122.128:9404] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bvi-boat-registration.com"] [uri "/.htaccess"] [unique_id "atCoVMpGBviHPX5Q1R3XGAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-15 10:17:24
(1 day ago)
Multiple WAF Violations
Web App Attack
🇩🇪
MusicLibrary
2026-10-15 09:20:09
(1 day ago)
Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 06:35:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:35:06.798953 2026] [security2:error] [pid 8729:tid 8729] [client 162.158.122.128:10383] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rwfrancis.com"] [uri "/.env.old"] [unique_id "atB0GkL8AhopJFxZdkNliwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-07 16:37:11
(1 week ago)
Web App Attack
🇧🇷
paradoxnetworks
2026-10-06 04:29:22
(1 week ago)
2026-10-06T04:22:18.984166+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[523619]: pam_unix(sshd:a ...
show more
2026-10-06T04:22:18.984166+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[523619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.122.128
2026-10-06T04:22:20.623684+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[523619]: Failed password for invalid user userftp from 162.158.122.128 port 58974 ssh2
2026-10-06T04:29:22.006635+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[524872]: Invalid user r-config-09 from 162.158.122.128 port 51690
...
show less
Brute-Force
SSH
🇧🇷
paradoxnetworks
2026-09-24 02:45:19
(3 weeks ago)
2026-09-24T02:43:12.155958+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[2277978]: pam_unix(sshd: ...
show more
2026-09-24T02:43:12.155958+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[2277978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.122.128
2026-09-24T02:43:14.081977+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[2277978]: Failed password for invalid user debian from 162.158.122.128 port 50654 ssh2
2026-09-24T02:45:18.991405+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[2278290]: Invalid user admin from 162.158.122.128 port 64248
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-09-03 20:03:05
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 16:03:00.356070 2026] [security2:error] [pid 18357:tid 18357] [client 162.158.122.128:10021] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wilmbifoundation.com.networkzone.org"] [uri "/.env.production.local"] [unique_id "apnSdBCEPmGTfQdTjLzknAAAAAU"], referer: https://www.google.com/search?q=www.wilmbifoundation.com.networkzone.org
show less
Brute-Force
Bad Web Bot
Web App Attack
