2026-08-09 04:33:34
(2 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇬🇧
openstrike.co.uk
2026-08-08 05:13:50
(2 months ago)
12 attacks on env grabbing URLs:
GET /storage/.env HTTP/1.1
Hacking
🇳🇱
homeshowdomain.nl
2026-08-07 21:59:50
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-06.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-08-07 14:20:23
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 10:20:18.061097 2026] [security2:error] [pid 2556453:tid 2556453] [client 2001:41d0:305:2100::1:3783:59016] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||marcedinc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "marcedinc.com"] [uri "/"] [unique_id "anXpoqtKKzChVH5DYFt-swAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
nzhost.co.nz
2026-08-07 13:58:56
(2 months ago)
$f2bV_matches
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-08-07 12:11:53
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 08:11:47.197287 2026] [security2:error] [pid 2427312:tid 2427397] [client 2001:41d0:305:2100::1:3783:51772] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||meeker.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "meeker.us"] [uri "/"] [unique_id "anXLg-xxos_6iW-c4xsk2AAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-08-07 11:58:31
(2 months ago)
Web App Attack Exploid from 2001:41d0:305:2100::1:3783
Web App Attack
🇩🇪
XICTRON
2026-08-07 10:05:06
(2 months ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 09:43:21
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:43:15.051057 2026] [security2:error] [pid 1703889:tid 1703889] [client 2001:41d0:305:2100::1:3783:40620] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lumecircadian.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lumecircadian.com"] [uri "/"] [unique_id "anWos3ILeQIuxjXnyTpkggAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-08-07 09:04:08
(2 months ago)
env leak on 276.today/admin/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 08:38:54
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 04:38:48.072737 2026] [security2:error] [pid 3602715:tid 3602715] [client 2001:41d0:305:2100::1:3783:58010] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mydobdate.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mydobdate.net"] [uri "/"] [unique_id "anWZmMMR8bXcinORFSuuoQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 08:10:16
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 04:10:10.465967 2026] [security2:error] [pid 1306383:tid 1306426] [client 2001:41d0:305:2100::1:3783:57100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lzmarketingsolutions.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lzmarketingsolutions.com"] [uri "/"] [unique_id "anWS4oRbeHgVZhsx4RhAywAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-08-07 07:54:27
(2 months ago)
[FriAug0709:54:24.4427292026][security2:error][pid875874:tid875923][client2001:41d0:305:2100::1:3783 ...
show more
[FriAug0709:54:24.4427292026][security2:error][pid875874:tid875923][client2001:41d0:305:2100::1:3783:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"morandi-trasporti.ch\"][uri\"/env/.env\"][unique_id\"anWPML3uB599eI_Hy_WsZQAAAEc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-08-07 07:48:00
(2 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 07:43:54
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ov ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:305:2100::1:3783 (vps-48825ca8.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 03:43:48.183253 2026] [security2:error] [pid 7316:tid 7316] [client 2001:41d0:305:2100::1:3783:57388] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||medicalsalesrepcareer.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "medicalsalesrepcareer.com"] [uri "/"] [unique_id "anWMtBVuR-WWNHDtMorknwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack