🇺🇸
TPI-Abuse
2026-09-29 11:50:04
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 07:49:56.674789 2026] [security2:error] [pid 7870:tid 7870] [client 162.158.159.166:10921] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||3905ccn.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "3905ccn.org"] [uri "/index.php.bak"] [unique_id "arul5G8EhZPbZ1nU-CP0CgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-03 22:01:01
(4 weeks ago)
Auto-ban: >3000 req/min op 2026-09-03
Web App Attack
SSH
Hacking
🇺🇸
mawan
2026-08-21 04:43:13
(1 month ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
freeutka
2026-05-10 15:00:19
(4 months ago)
WordPress brute-force login attempt on wp-login.php.
Brute-Force
Web App Attack
🇺🇸
drewf.ink
2026-04-24 17:08:19
(5 months ago)
[17:08] Port scanning. Port(s) scanned: TCP/8443
Port Scan
🇺🇸
TPI-Abuse
2026-03-21 05:08:09
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 01:08:05.584007 2026] [security2:error] [pid 20627:tid 20685] [client 162.158.159.166:12206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.dcsindo.com"] [uri "/app/.env"] [unique_id "ab4ntRSm-ID_Jx8YGdfSzgAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 09:24:53
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:24:48.590758 2026] [security2:error] [pid 2889:tid 2889] [client 162.158.159.166:13869] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.kittysalterations.com"] [uri "/.env.orig"] [unique_id "ab0SYE2N28YqviLqTu4W-gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:39:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:39:35.520958 2026] [security2:error] [pid 15343:tid 15343] [client 162.158.159.166:13878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "reneehill.mydobdate.net"] [uri "/.env.backup"] [unique_id "abyzZ2OO4YJfso_JijTKRAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:36:27
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:36:23.521492 2026] [security2:error] [pid 31813:tid 31813] [client 162.158.159.166:13867] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.lockdownclaim.com"] [uri "/docker/.env.local"] [unique_id "abvftwusYFd0LZk4I0zeIAAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:08:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:07:59.540803 2026] [security2:error] [pid 22467:tid 22467] [client 162.158.159.166:13867] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cthog.xyz"] [uri "/web/.env"] [unique_id "abvZD5C1pxXc0N8ykEAgVQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 10:18:53
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 06:18:36.107411 2026] [security2:error] [pid 12302:tid 12302] [client 162.158.159.166:12017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.myclassicvw.com"] [uri "/.env.local.backup"] [unique_id "abvNfLmQ7F_V9gtmZpRe1QAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 09:49:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 05:49:32.418285 2026] [security2:error] [pid 24293:tid 24293] [client 162.158.159.166:9438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.qavideo.com"] [uri "/.env2"] [unique_id "abvGrAZgTm2nauvP5r_hJAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 08:39:54
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 04:39:47.478756 2026] [security2:error] [pid 5184:tid 5184] [client 162.158.159.166:10542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gracebaptisthartsville.com"] [uri "/.env.prod"] [unique_id "abu2U8hvFxBji5ltGPxeRgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 07:34:42
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 03:34:36.085413 2026] [security2:error] [pid 26812:tid 26812] [client 162.158.159.166:11334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeanniemorrislaw.com"] [uri "/.env.old"] [unique_id "abunDJuw1L0-Rv453tQrpAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 06:51:47
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.159.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 02:51:43.433421 2026] [security2:error] [pid 4496:tid 4496] [client 162.158.159.166:9505] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "forerunnersjazz.org"] [uri "/.env.test"] [unique_id "abuc__IZd-gI7pFhixLfngAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
