🇺🇸
TPI-Abuse
2026-09-28 19:43:45
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 15:43:41.293928 2026] [security2:error] [pid 14339:tid 14339] [client 162.158.159.137:11281] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bearssd.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bearssd.org"] [uri "/index.php.bak"] [unique_id "arrDbTKazT10UnhqibZBrwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 14:13:37
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 10:13:31.738332 2026] [security2:error] [pid 29465:tid 29465] [client 162.158.159.137:10480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "personal-sportswear.com"] [uri "/.htaccess"] [unique_id "arfTC_hU96GbGzCVDPRDKgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 12:14:30
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 08:14:27.120284 2026] [security2:error] [pid 25636:tid 25757] [client 162.158.159.137:11416] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "laradioactivitat.com"] [uri "/wp-config.php.bak"] [unique_id "are3IwPraZHDedbyJRYBjQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
paradoxnetworks
2026-09-14 12:51:04
(2 weeks ago)
2026-09-14T12:50:54.077050+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[431271]: Failed password ...
show more
2026-09-14T12:50:54.077050+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[431271]: Failed password for root from 162.158.159.137 port 49515 ssh2
2026-09-14T12:50:59.125950+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[431271]: Failed password for root from 162.158.159.137 port 49515 ssh2
2026-09-14T12:51:03.281982+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[431271]: Failed password for root from 162.158.159.137 port 49515 ssh2
...
show less
Brute-Force
SSH
🇺🇸
LotPhantom
2026-03-30 19:19:13
(6 months ago)
2026/03/30 19:19:11 [error] 109153#109153: *62793 access forbidden by rule, client: 162.158.159.137, ...
show more
2026/03/30 19:19:11 [error] 109153#109153: *62793 access forbidden by rule, client: 162.158.159.137, server: api.bridginggaps.tech, request: "GET /.env.backup HTTP/2.0", host: "api.bridginggaps.tech"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 04:33:24
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 00:33:17.026559 2026] [security2:error] [pid 31330:tid 31330] [client 162.158.159.137:11904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.sixsensehealing.com"] [uri "/server/.env"] [unique_id "ab4fjXaaU4hS3WfHxWDX0AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 01:56:30
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 21:56:22.958465 2026] [security2:error] [pid 17951:tid 17951] [client 162.158.159.137:11960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.flightclaimservices.com"] [uri "/.env_settings"] [unique_id "ab36xigxZAY_ue8L1MG3PQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:15:03
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:14:57.938024 2026] [security2:error] [pid 26893:tid 26893] [client 162.158.159.137:11112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.bebloor.ca"] [uri "/.env.php"] [unique_id "abzJwZynNErrQjy2JWGUfwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:13:31
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:13:25.034014 2026] [security2:error] [pid 24337:tid 24337] [client 162.158.159.137:14331] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "truecontrarian.com"] [uri "/.envrc"] [unique_id "abyfNQiHnC9JxNiqOluR7gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 10:31:21
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 06:31:18.547094 2026] [security2:error] [pid 20000:tid 20000] [client 162.158.159.137:12845] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.circleinthesquare.org"] [uri "/.env.example"] [unique_id "abvQdjlTA4dcsugerAOp1AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 10:15:11
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 06:14:59.766845 2026] [security2:error] [pid 28136:tid 28136] [client 162.158.159.137:12795] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rayeliotschwartz.zenmonkeyproject.com"] [uri "/.env1"] [unique_id "abvMo5mOYjTX8ISnBfaxXwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:45:33
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:45:25.960041 2026] [security2:error] [pid 15795:tid 15795] [client 162.158.159.137:11843] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.amplifihearing.com"] [uri "/var/www/.env"] [unique_id "abvFtbFDPkBfj2MMqf1A3gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:28:00
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:27:56.162306 2026] [security2:error] [pid 27980:tid 27980] [client 162.158.159.137:11593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.chatsupply.us"] [uri "/.env_secret"] [unique_id "abvBnACa5pspk48UT2ONKgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:07:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:07:37.393847 2026] [security2:error] [pid 22024:tid 22024] [client 162.158.159.137:13488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wolter-hausser.com"] [uri "/.git/logs/HEAD"] [unique_id "abu82ZSPCp0fEJjI9-F28wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 08:21:20
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 04:21:13.023741 2026] [security2:error] [pid 11638:tid 11638] [client 162.158.159.137:12333] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blfmarine.com.lakesidedetectiveagency.com"] [uri "/.env.test"] [unique_id "abux-QXL4T4E4m_5RjTX8AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
