🇺🇸
TPI-Abuse
2026-09-06 10:38:14
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 06:38:07.499047 2026] [security2:error] [pid 17033:tid 17033] [client 204.217.128.213:41767] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.texasbordertours.com"] [uri "/.env"] [unique_id "ap1Cj3n6aTKK2Grzec5hPAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-09-03 04:39:30
(3 days ago)
Brute force
Brute-Force
🇺🇸
TPI-Abuse
2026-09-02 23:18:52
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:18:47.633278 2026] [security2:error] [pid 30157:tid 30157] [client 204.217.128.213:55727] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apiu15_iyAtyAg1U05uB7wAAAAk"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 18:08:50
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 14:08:41.484045 2026] [security2:error] [pid 30284:tid 30284] [client 204.217.128.213:34769] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "apHOqV7seuUH9FSd74udEwAAAA4"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-22 01:22:36
(1 month ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 00:32:23
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 20:32:16.114018 2026] [security2:error] [pid 21470:tid 21470] [client 204.217.128.213:26931] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||TransCapitalSolutions.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "transcapitalsolutions.com"] [uri "/mailto:[email protected] "] [unique_id "aitTkDpPlwwXkrjrqHqZQAAAAAA"], referer: http://TransCapitalSolutions.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-05-28 22:03:17
(3 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 01-03.204.217.128.213.web-spam ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 01-03.204.217.128.213.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇱🇻
garmtech.com
2026-04-17 03:26:35
(4 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 06-26.204.217.128.213.web-spam ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 06-26.204.217.128.213.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 15:34:26
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 11:34:09.189902 2026] [security2:error] [pid 6855:tid 6855] [client 204.217.128.213:57021] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aclGccRzd2O3S18OUo9LEgAAACU"], referer: http://www.capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 21:38:08
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 16:38:02.925389 2026] [security2:error] [pid 3353:tid 3353] [client 204.217.128.213:28051] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||InvestorsFundingUSA.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "investorsfundingusa.com"] [uri "/mailto:[email protected] "] [unique_id "aYulOghj-vz1uG8KOoI03AAAAAY"], referer: http://InvestorsFundingUSA.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-24 23:35:49
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.128.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 24 18:35:44.232209 2026] [security2:error] [pid 20825:tid 20825] [client 204.217.128.213:29563] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||persnicketyinc.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "persnicketyinc.com"] [uri "/mailto:[email protected] "] [unique_id "aXVXUKwJE_hNBqQfZNAiqwAAAAM"], referer: http://persnicketyinc.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
agenciahypelab.com.br
2025-12-18 18:31:01
(8 months ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇮🇩
BPS-StatisticsIndonesia
2025-04-15 20:17:42
(1 year ago)
WP Login Scan Activities
Web App Attack
🇺🇸
Psycho Solutions LLC
2025-04-12 19:29:25
(1 year ago)
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N ...
show more
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 4/12/2025 7:29 pm (UTC-6)
show less
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇺🇸
Psycho Solutions LLC
2025-04-10 20:36:13
(1 year ago)
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N ...
show more
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 4/10/2025 8:36 pm (UTC-6)
show less
Web Spam
Hacking
Bad Web Bot
Web App Attack
