🇺🇸
TPI-Abuse
2026-10-15 23:24:06
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:23:53.871394 2026] [security2:error] [pid 8411:tid 8411] [client 162.158.122.176:13444] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jewson.org"] [uri "/.env.old"] [unique_id "atFgiaxAem4UGIIrf0Ma2AAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 23:08:30
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:08:24.570945 2026] [security2:error] [pid 5053:tid 5081] [client 162.158.122.176:11275] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ewoolsey.com"] [uri "/.env.backup"] [unique_id "atFc6ALfqBHKDHNdkx5C3wAAAVc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 22:47:25
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 18:47:12.608571 2026] [security2:error] [pid 8686:tid 8686] [client 162.158.122.176:10111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "qwixel.com"] [uri "/.git/HEAD"] [unique_id "atFX8Efw-vuAvuHSs4tvqwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 18:39:24
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 14:39:02.822301 2026] [security2:error] [pid 27339:tid 27339] [client 162.158.122.176:12196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pakistanvision.com"] [uri "/wp-config.php.old"] [unique_id "atEdxiLbRFBYczWEQTQ6UwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-15 17:47:23
(4 days ago)
[15/Oct/2026:20:47:23 +0300] -- 162.158.122.176 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.e ...
show more
[15/Oct/2026:20:47:23 +0300] -- 162.158.122.176 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.production HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 15:41:35
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:41:27.820088 2026] [security2:error] [pid 24978:tid 24978] [client 162.158.122.176:11195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wetlizarddiveteam.com"] [uri "/.env.dev"] [unique_id "atD0JztmiFXuqWzqWfsjzAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 15:06:36
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:06:21.379664 2026] [security2:error] [pid 23042:tid 23090] [client 162.158.122.176:13662] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "the-aquifer.com"] [uri "/.env"] [unique_id "atDr7ZeHj82UYP-ssF8u9QAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
1337v411
2026-10-15 13:59:22
(5 days ago)
[2026-10-15T13:59:22+00:00] uri="//.aws/credentials" ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit ...
show more
[2026-10-15T13:59:22+00:00] uri="//.aws/credentials" ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:20:14
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:20:06.176636 2026] [security2:error] [pid 14384:tid 14384] [client 162.158.122.176:9823] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeremymetzger.com"] [uri "/.env.bak"] [unique_id "atDTBruwClKudApfuW4C3wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:33:38
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:33:20.601817 2026] [security2:error] [pid 29868:tid 29868] [client 162.158.122.176:12254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drainpoultry.com"] [uri "/.env.save"] [unique_id "atDIEB0Z2o5AuB3ULy3oawAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
bohl-aiG5aef
2026-10-15 12:02:31
(5 days ago)
Suricata Alert [SID:2019526] ET WEB_SERVER WEB-PHP phpinfo access
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:50:24
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:50:06.939547 2026] [security2:error] [pid 11784:tid 11784] [client 162.158.122.176:9263] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webersource.com"] [uri "/.env.dev"] [unique_id "atCv3qHfCxlw4HMAHGBPKgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 10:22:21
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.122.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 06:22:06.578677 2026] [security2:error] [pid 10519:tid 10543] [client 162.158.122.176:12261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "woodamy.com"] [uri "/.env.dev"] [unique_id "atCpTl3I820EDp4dXUj8zAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
vtchost.com
2026-10-15 09:54:12
(5 days ago)
to many 403 http errors
...
Brute-Force
🇫🇷
dynamix
2026-10-15 08:51:59
(5 days ago)
Multiple WAF Violations
Web App Attack
