🇳🇱
Mangelot Hosting
2026-05-29 10:16:49
(3 weeks ago)
(db_admin_scan) srv101 DB admin scan 192.154.250.136 (US/United States/-): 1 in the last 3600 secs; ...
show more
(db_admin_scan) srv101 DB admin scan 192.154.250.136 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
mnsf
2026-05-29 10:05:59
(3 weeks ago)
Abuse Detected (1)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-28 16:36:59
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 12:36:52.469159 2026] [security2:error] [pid 7188:tid 7188] [client 192.154.250.136:37281] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tnthandy.com.inetbrain.com"] [uri "/wp-config.php"] [unique_id "ahhvJKog-c3W-bUfEf7F6AAAABk"], referer: https://www.google.com/search?q=www.tnthandy.com.inetbrain.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-05-28 01:11:07
(3 weeks ago)
[ThuMay2803:10:59.8654912026][security2:error][pid1761960:tid1762081][client192.154.250.136:0]ModSec ...
show more
[ThuMay2803:10:59.8654912026][security2:error][pid1761960:tid1762081][client192.154.250.136:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.aid-web.ch.81-17-25-250.cpanel.site\"][uri\"/.env.development.local\"][unique_id\"aheWI4fBA0NxDvxCBg-UpgAAAAY\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 22:44:31
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 18:43:47.447385 2026] [security2:error] [pid 10794:tid 10794] [client 192.154.250.136:33165] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.naturallyneworleans.anthonyjoseph.us|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.naturallyneworleans.anthonyjoseph.us"] [uri "/config/master.key"] [unique_id "ahdzo7BIk_LSRTqTziu1DQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-05-27 16:15:57
(3 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 16:12:35
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 12:12:14.563343 2026] [security2:error] [pid 14453:tid 14453] [client 192.154.250.136:50765] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.villamarehiltonhead.empoweruohio.org"] [uri "/.env.dusk.local"] [unique_id "ahcX3rxCLvJ8WEuvyXR3MgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-27 13:44:10
(3 weeks ago)
(caddyscan) Scanner path probe from 192.154.250.136 (US/United States/-): 5 in the last 3600 secs; P ...
show more
(caddyscan) Scanner path probe from 192.154.250.136 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 192.154.250.136 - - [27/May/2026:13:44:08 +0000] "GET /.aws/credentials HTTP/1.1"
[REDACTED] 200 2627 192.154.250.136 - - [27/May/2026:13:44:08 +0000] "GET /wp-config.php HTTP/1.1"
[REDACTED] 200 2627 192.154.250.136 - - [27/May/2026:13:44:08 +0000] "GET /.env.backup HTTP/1.1"
[REDACTED] 200 2627 192.154.250.136 - - [27/May/2026:13:44:08 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 192.154.250.136 - - [27/May/2026:13:44:09 +0000] "GET /.env.save HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-27 11:54:28
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 07:54:21.905744 2026] [security2:error] [pid 11739:tid 11739] [client 192.154.250.136:41973] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.closedfortheseason.com"] [uri "/.env.local"] [unique_id "ahbbbRyHHyUSq7EvPZXGfwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
René Hickersberger
2026-05-27 02:13:14
(3 weeks ago)
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 AppleWebKit/537. ...
show more
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-27 00:22:37
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:22:29.492235 2026] [security2:error] [pid 1498:tid 1498] [client 192.154.250.136:56409] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.willmarksynthetics.cosentient.com"] [uri "/.env.bak"] [unique_id "ahY5RbVYciIA7LabZNxsnQAAAAA"], referer: https://www.google.com/search?q=www.willmarksynthetics.cosentient.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-26 21:59:03
(3 weeks ago)
Auto-ban: >3000 req/min op 2026-05-26
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-26 17:09:29
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 13:09:21.385594 2026] [security2:error] [pid 4115:tid 4115] [client 192.154.250.136:54147] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||digitview.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "digitview.com"] [uri "/backup.sql"] [unique_id "ahXTwf2DALCaH_3SZd1cEAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-17 06:27:36
(5 months ago)
(mod_security) mod_security (id:226830) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:226830) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 01:27:31.241395 2026] [security2:error] [pid 18866:tid 18866] [client 192.154.250.136:43863] ModSecurity: Access denied with code 403 (phase 1). Operator GE matched 1 at ARGS_GET. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6392"] [id "226830"] [rev "2"] [msg "COMODO WAF: Open redirect vulnerability in the Redirect function in the StageShow plugin before 5.0.9 for WordPress (CVE-2015-5461)||cpcalendars.nbcnewsradio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/wp-content/plugins/stageshow/stageshow_redirect.php"] [unique_id "aWsr08HoZMIMO1pjH3KljgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 21:20:51
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 192.154.250.136 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 16:20:45.755277 2025] [security2:error] [pid 21673:tid 21688] [client 192.154.250.136:51639] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staging.kettlehill.com"] [uri "/wp-config.php.inc"] [unique_id "aVLwrdoKFoxlNLdnJRxOrQAAAEw"]
show less
Brute-Force
Bad Web Bot
Web App Attack