🇺🇸
TPI-Abuse
2026-07-27 02:35:47
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 22:35:36.909956 2026] [security2:error] [pid 3823125:tid 3823125] [client 165.154.236.229:60300] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.50"] [uri "/.env"] [unique_id "ambD-BV33lipdW2nb1A0CgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 23:37:27
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 19:37:09.392979 2026] [security2:error] [pid 2932853:tid 2932882] [client 165.154.236.229:60012] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.21"] [uri "/.env"] [unique_id "amaaJRE0uvwZgaGy967kxwAAAJg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 18:07:06
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 14:06:56.845604 2026] [security2:error] [pid 2715454:tid 2715454] [client 165.154.236.229:36910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.55"] [uri "/.env"] [unique_id "amZMwNpTeiUye4Xrfg5NTQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-07-26 17:03:26
(22 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
2026-07-26 16:25:06
(23 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 165.154.236.229 (SG/Singapore/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-07-26 03:10:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 23:10:23.667803 2026] [security2:error] [pid 2109629:tid 2109629] [client 165.154.236.229:43154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.27"] [uri "/.env.local"] [unique_id "amV6n6_rS-pzURPB9pFEIQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 00:09:28
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 20:09:22.402848 2026] [security2:error] [pid 1213:tid 1213] [client 165.154.236.229:40044] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.179:443|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.179"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "amVQMqIIEgbakqMkZaTVHAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-07-25 22:47:41
(1 day ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-25 18:26:20
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 14:26:03.086935 2026] [security2:error] [pid 2005041:tid 2005041] [client 165.154.236.229:39966] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.146"] [uri "/.env"] [unique_id "amT_uzUbzvkZQGNRd4t30AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 03:13:51
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 23:13:35.750093 2026] [security2:error] [pid 814895:tid 814895] [client 165.154.236.229:45142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.209"] [uri "/.env"] [unique_id "amQp3198oRVwJRgChy8oUwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Starburst SysOp Team
2026-07-25 00:59:32
(2 days ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-24 23:56:52
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 19:56:40.923055 2026] [security2:error] [pid 253899:tid 253899] [client 165.154.236.229:48964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.174"] [uri "/.env"] [unique_id "amP7uLh5QFXu7vUuwz3-9wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-07-24 22:48:27
(2 days ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-13)
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-24 19:20:31
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 15:20:13.561382 2026] [security2:error] [pid 948378:tid 948378] [client 165.154.236.229:40134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.99"] [uri "/.env.backup"] [unique_id "amO67cjeNJla9p6lVF9jIAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 19:04:17
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.236.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 15:04:02.494736 2026] [security2:error] [pid 4158:tid 4158] [client 165.154.236.229:40080] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.199"] [uri "/.env"] [unique_id "amO3IuXqxXmktjjlrIWJYAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack