🇧🇪
madeit
2026-09-27 13:18:12
(1 day ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 11:36:26
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 07:36:23.458878 2026] [security2:error] [pid 28404:tid 28404] [client 162.158.159.149:9443] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "geofreightint.com"] [uri "/.htaccess"] [unique_id "areuN1LTibC3czl5T12GRQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-26 10:05:29
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 06:05:21.578492 2026] [security2:error] [pid 16495:tid 16495] [client 162.158.159.149:11339] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tribwatch.com"] [uri "/wp-config.php.bak"] [unique_id "areY4Z4XIQyb0pwT1KyJ3AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-17 06:26:54
(1 week ago)
Web App Attack
🇫🇷
dynamix
2026-08-23 08:58:30
(1 month ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-08-20 12:34:41
(1 month ago)
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-08-04 02:09:40
(1 month ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇯🇵
S.O.B.A. Dev.
2026-07-26 08:51:03
(2 months ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇯🇵
S.O.B.A. Dev.
2026-07-05 07:18:01
(2 months ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇺🇸
mnsf
2026-04-03 17:05:50
(5 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-03-31 17:07:16
(5 months ago)
Scanning/Probing (17)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:27:17
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:27:10.249840 2026] [security2:error] [pid 11214:tid 11214] [client 162.158.159.149:13540] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.mavrik12.com"] [uri "/.env.production.local"] [unique_id "abzMnnLJDiXSvOsu-YUedAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:19:39
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:19:31.917072 2026] [security2:error] [pid 29338:tid 29338] [client 162.158.159.149:10351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.donshotrodshop.net"] [uri "/.env.production"] [unique_id "aby8w2EoMLgLPs--Y6T_AwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:34:13
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:34:10.311618 2026] [security2:error] [pid 23147:tid 23147] [client 162.158.159.149:12315] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.globalweb123.com"] [uri "/.env~"] [unique_id "abyyIoC3DLPtvgiZSVjlOQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:27:42
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:27:33.682867 2026] [security2:error] [pid 27170:tid 27170] [client 162.158.159.149:13189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.chatsupply.us"] [uri "/web/.env"] [unique_id "abvBhQikgE3CHSzCEmIiCgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
