2026-07-18 23:38:55
(1 day ago)
Web App Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 09:24:24
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 05:24:17.146254 2026] [security2:error] [pid 11759:tid 11759] [client 172.68.245.32:13922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.santaclausphonecall.com.evannine.com"] [uri "/.env"] [unique_id "agbmQWVWhoYtfEOFp8lA9gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:12:30
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:10:39.366257 2026] [security2:error] [pid 1293:tid 1293] [client 172.68.245.32:11193] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.galaxymarble.quest.38floorsupply.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.galaxymarble.quest.38floorsupply.com"] [uri "/backup.sql"] [unique_id "agbU_ykfObZq04QaqASG8AAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-14 22:06:22
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-13.
show less
Web App Attack
SSH
Hacking
2026-05-04 12:54:56
(2 months ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇺🇸
wimaxnz
2026-04-16 01:53:00
(3 months ago)
Automated report from 247 Guardian: repeated malicious activity detected. | reason=nginx_badpath
Brute-Force
SSH
Port Scan
2026-04-15 13:34:01
(3 months ago)
Web App Attack
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 05:56:25
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 01:56:20.884716 2026] [security2:error] [pid 11236:tid 11236] [client 172.68.245.32:13214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.wellness-mastery.com"] [uri "/public/.env"] [unique_id "actiBIhfQTmokW-VJtJrBAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 01:17:32
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 21:17:27.386518 2026] [security2:error] [pid 24246:tid 24246] [client 172.68.245.32:10876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "khodel.info"] [uri "/.env.dist"] [unique_id "acsgp4c_9bgh4FgHovluhQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 17:59:45
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 13:59:40.672982 2026] [security2:error] [pid 31816:tid 31816] [client 172.68.245.32:10530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.castagnino.com"] [uri "/.env_config"] [unique_id "acq6DC0lAfUzHj8AnbRClAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 15:41:02
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 11:40:56.108986 2026] [security2:error] [pid 24131:tid 24186] [client 172.68.245.32:12822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.i-masmx.com"] [uri "/.env.orig"] [unique_id "acqZiIupMgUmfag6HMgUEwAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 12:41:39
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 08:41:32.842045 2026] [security2:error] [pid 18413:tid 18413] [client 172.68.245.32:13033] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alextra.org"] [uri "/.env.bak"] [unique_id "acpvfEgplttFUDx_i4nimwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 06:49:51
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 02:49:44.641447 2026] [security2:error] [pid 11327:tid 11327] [client 172.68.245.32:12455] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.elhosting.us"] [uri "/.env.save"] [unique_id "acodCAAakoey1Ool2kIpfwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 05:14:18
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 01:14:11.545898 2026] [security2:error] [pid 28932:tid 28932] [client 172.68.245.32:10314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.vendor21.com"] [uri "/.env~"] [unique_id "acoGo1GLZczjVXQ2fttlxQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 02:45:54
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.245.32 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 22:45:46.911600 2026] [security2:error] [pid 22762:tid 22762] [client 172.68.245.32:11666] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.aboutio.com"] [uri "/.env.development.local"] [unique_id "acnj2iLl_S5rgbl0ptQFsgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack