🇺🇸
TPI-Abuse
2026-09-17 10:36:38
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 06:36:33.333493 2026] [security2:error] [pid 8643:tid 8659] [client 2001:41d0:269:4200:::33170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "testproperty.pref-realestate.com"] [uri "/wp-config.php.bak"] [unique_id "aqvCsUXOGuoxon4BgEEIzgAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 10:10:44
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 06:10:39.340998 2026] [security2:error] [pid 20580:tid 20580] [client 2001:41d0:269:4200:::40430] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.newhopepetgrooming.leonardodecaprio.com"] [uri "/wp-config.php.bak"] [unique_id "aqu8n6OULy9sSN2EfngfygAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-17 10:03:10
(4 weeks ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
TPI-Abuse
2026-09-17 09:02:36
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 05:02:29.439336 2026] [security2:error] [pid 21255:tid 21255] [client 2001:41d0:269:4200:::56292] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hayrun.com"] [uri "/wp-config.php.bak"] [unique_id "aquspfnbdrNMtdZ1LWhlfQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-17 08:34:16
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 04:34:09.186479 2026] [security2:error] [pid 25679:tid 25679] [client 2001:41d0:269:4200:::39210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "photospecialties.net"] [uri "/.git/config"] [unique_id "aqumAUikyx6_jZrHLaUzugAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-17 08:32:56
(4 weeks ago)
Try to access /.git/config
Web App Attack
2026-09-17 08:03:39
(4 weeks ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇩🇪
LRob
2026-09-17 07:59:10
(4 weeks ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: / | 2026-09-17 07:59 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-17 07:56:33
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 03:56:26.793513 2026] [security2:error] [pid 923:tid 923] [client 2001:41d0:269:4200:::51464] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thehealthyplaceclayton.com"] [uri "/wp-config.php.bak"] [unique_id "aqudKi4p4qqJWul7ymXfrAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-17 07:53:15
(4 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-17 07:25:06
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 03:25:00.622553 2026] [security2:error] [pid 28913:tid 28913] [client 2001:41d0:269:4200:::34096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kbalan.com"] [uri "/wp-config.php.bak"] [unique_id "aquVzAcuAbLPQtECO1yh7gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
arsonist
2026-09-17 07:06:28
(4 weeks ago)
[fail2ban]
2026-09-17T07:06:27.899078+00:00 arson caddy[1890453]: {"level":"info","ts":1789628787.89 ...
show more
[fail2ban]
2026-09-17T07:06:27.899078+00:00 arson caddy[1890453]: {"level":"info","ts":1789628787.8989441,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"2001:41d0:269:4200::","remote_port":"44604","client_ip":"2001:41d0:269:4200::","proto":"HTTP/1.1","method":"GET","host":"code.arson.cloud","uri":"/.git/config","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"code.arson.cloud","ech":false}},"bytes_read":0,"user_id":"","duration":0.000056056,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-17 07:05:27
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 03:05:20.103879 2026] [security2:error] [pid 11276:tid 11276] [client 2001:41d0:269:4200:::34162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scraggw.com"] [uri "/.git/config"] [unique_id "aquRMOJWWVhO5e6mXBMNjQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-17 06:49:57
(4 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 2001:41d0:269:4200:: (Unknown)
SQL Injection
🇺🇸
TPI-Abuse
2026-09-17 06:45:37
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:41d0:269:4200:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 02:45:30.931035 2026] [security2:error] [pid 30447:tid 30471] [client 2001:41d0:269:4200:::34724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pwihatah.plumeraproductions.com"] [uri "/wp-config.php.bak"] [unique_id "aquMinUS9GDco2LlR-4_ZQAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
