2026-08-09 04:33:29
(2 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇳🇱
homeshowdomain.nl
2026-08-07 21:59:49
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-06.
show less
Web App Attack
SSH
Hacking
🇩🇪
4server
2026-08-07 13:46:09
(2 months ago)
[FriAug0715:46:03.6428222026][security2:error][pid1211825:tid1211869][client2001:41d0:701:1100::45cc ...
show more
[FriAug0715:46:03.6428222026][security2:error][pid1211825:tid1211869][client2001:41d0:701:1100::45cc:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"buletti-panettoni.ch\"][uri\"/env/.env\"][unique_id\"anXhm2ClPYvSA-agWM68lQAAAEE\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 13:21:32
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 09:21:27.194638 2026] [security2:error] [pid 2563927:tid 2563927] [client 2001:41d0:701:1100::45cc:53888] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||abneyfoundation.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "abneyfoundation.org"] [uri "/"] [unique_id "anXb1-MQiGcovY6hyQfIzwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 11:54:57
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 07:54:53.654572 2026] [security2:error] [pid 18289:tid 18298] [client 2001:41d0:701:1100::45cc:38106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bayouwebmaster.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bayouwebmaster.com"] [uri "/"] [unique_id "anXHjT5Mc4H6encMP_X_JQAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 11:35:29
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 07:35:21.079096 2026] [security2:error] [pid 2427315:tid 2427393] [client 2001:41d0:701:1100::45cc:54568] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ccgparquitectos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ccgparquitectos.com"] [uri "/"] [unique_id "anXC-XIhlSuWhyKSF1h_vwAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 10:54:27
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 06:54:23.940278 2026] [security2:error] [pid 2448504:tid 2448504] [client 2001:41d0:701:1100::45cc:58750] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||acctusa.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "acctusa.net"] [uri "/"] [unique_id "anW5XyQnKbaDFrWyvKVK6QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 10:14:48
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 06:14:42.850402 2026] [security2:error] [pid 3269555:tid 3269555] [client 2001:41d0:701:1100::45cc:38984] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fwa51.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fwa51.com"] [uri "/"] [unique_id "anWwEg2Ewdpm_5_KRE9tTwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 09:54:33
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:54:28.467114 2026] [security2:error] [pid 1933598:tid 1933598] [client 2001:41d0:701:1100::45cc:60748] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||calebdavison.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "calebdavison.com"] [uri "/"] [unique_id "anWrVLKx-HmWN7ElsXY3QQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 09:22:15
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 05:22:10.309193 2026] [security2:error] [pid 2542178:tid 2542178] [client 2001:41d0:701:1100::45cc:34676] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ggdome.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ggdome.org"] [uri "/"] [unique_id "anWjwo4xUJYqUHHs9XzgeAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 08:59:39
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 04:59:31.559040 2026] [security2:error] [pid 17616:tid 17616] [client 2001:41d0:701:1100::45cc:56382] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||fullyevil.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fullyevil.com"] [uri "/"] [unique_id "anWecwpiyr1J5Yy2Dwix8QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-08-07 08:13:04
(2 months ago)
Brute-force attack to non-existent web resources, HTTP code 404.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 07:52:07
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 03:52:00.006301 2026] [security2:error] [pid 3259087:tid 3259087] [client 2001:41d0:701:1100::45cc:41634] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bigchus.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bigchus.com"] [uri "/"] [unique_id "anWOn475wz6_NbHsUa7HigAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 07:29:04
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 03:28:57.017109 2026] [security2:error] [pid 10915:tid 10915] [client 2001:41d0:701:1100::45cc:50838] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dogandponyband.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dogandponyband.com"] [uri "/"] [unique_id "anWJOb5zKIxWUsVf2-F97AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-07 07:06:42
(2 months ago)
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh. ...
show more
(mod_security) mod_security (id:210350) triggered by 2001:41d0:701:1100::45cc (vps-720b69cf.vps.ovh.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 03:06:35.637306 2026] [security2:error] [pid 1306457:tid 1306480] [client 2001:41d0:701:1100::45cc:42284] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||metastrata.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "metastrata.com"] [uri "/"] [unique_id "anWD-1UsvVQKeenCtyV3mwAAAQs"]
show less
Brute-Force
Bad Web Bot
Web App Attack