🇲🇾
Rizzy
2026-10-11 20:02:24
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 15:38:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 11:38:50.829682 2026] [security2:error] [pid 18443:tid 18443] [client 172.71.183.194:13270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "justiart.com"] [uri "/.env.dev"] [unique_id "asutiq-q7V55NhEH3s7duwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hary74656
2026-10-10 18:48:44
(2 days ago)
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 172.71.183.194] [realclien ...
show more
Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1.
[client 172.71.183.194] [realclient 172.71.183.194] [10/Oct/2026:20:48:43 +0200] [vhost aschi.at] 403 "GET /.git-credentials HTTP/2.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 15:42:46
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 11:42:41.168644 2026] [security2:error] [pid 8109:tid 8109] [client 172.71.183.194:10124] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||acmyles.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "acmyles.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "aspc8R5Vt8P_HZLbeLqIOwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 08:40:18
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 04:40:02.514794 2026] [security2:error] [pid 13094:tid 13094] [client 172.71.183.194:11958] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.barbaraehill.com"] [uri "/.env.staging"] [unique_id "asn54j-5uNn_tSm10j5CQgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 07:01:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 03:01:01.427717 2026] [security2:error] [pid 19268:tid 19268] [client 172.71.183.194:12129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "copiersgreensboro.com"] [uri "/.env.local"] [unique_id "asnircLdnV-tP6s54fS7ywAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
Gem
2026-10-09 22:08:01
(2 days ago)
Unauthorized web scan.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 20:11:14
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 16:11:11.842565 2026] [security2:error] [pid 17926:tid 17926] [client 172.71.183.194:11738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "qosmexico.com"] [uri "/.env.staging"] [unique_id "aslKX8RvMl6BEpWNj8UoxQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-09 15:05:12
(3 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇦🇺
crispi
2026-10-09 10:39:49
(3 days ago)
Port scan from 172.71.183.194
Port Scan
🇺🇸
TPI-Abuse
2026-10-08 20:27:54
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:27:47.715780 2026] [security2:error] [pid 26384:tid 26384] [client 172.71.183.194:10702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.donutlocations.com"] [uri "/.env.old"] [unique_id "asf8w_Vo14rMaR48tB8jjwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 17:20:41
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 13:20:33.216642 2026] [security2:error] [pid 14760:tid 14760] [client 172.71.183.194:10770] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jwilder.com"] [uri "/.env.local"] [unique_id "asfQ4ekohAGuQ8lYH8T3ZgAAADg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 16:10:36
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 12:10:27.961072 2026] [security2:error] [pid 32603:tid 32603] [client 172.71.183.194:11133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nnrentacar.com"] [uri "/.env.old"] [unique_id "asfAc2R3g80HjRsAfl-NUAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-08 11:40:56
(4 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 09:12:47
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.183.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 05:12:39.467311 2026] [security2:error] [pid 13987:tid 13987] [client 172.71.183.194:9764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brasscadillac.com"] [uri "/.git/config"] [unique_id "asdeh7_L7ZCHbvbcqE8skwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
