🇺🇸
TPI-Abuse
2026-10-03 07:45:12
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 03:45:06.429503 2026] [security2:error] [pid 14973:tid 14973] [client 206.232.2.90:45725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "genevaatlantic.com"] [uri "/.git/HEAD"] [unique_id "asCygu96SJIm_OhGIyp0NgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 16:39:03
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 12:38:20.328499 2026] [security2:error] [pid 7323:tid 7323] [client 206.232.2.90:61785] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.russiacoin.info"] [uri "/sftp-config.json"] [unique_id "arAL_CTCJoDaKmhLfExX9AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
mkln.org
2026-09-20 05:58:08
(3 weeks ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇩🇪
LRob
2026-09-18 17:10:37
(3 weeks ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env.orig | 2026-09-18 17:10 UTC
show less
Hacking
Web App Attack
🇩🇪
LRob
2026-09-15 02:45:08
(3 weeks ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /bourgogne-franche-comte | 2026-09-15 02:45 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-10 19:47:46
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 15:47:42.416096 2026] [security2:error] [pid 27537:tid 27537] [client 206.232.2.90:41661] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||genevainvestors.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "genevainvestors.com"] [uri "/mailto:[email protected] "] [unique_id "aqMJXjE_bH0vkXtM_nQk7QAAAAI"], referer: http://genevainvestors.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-03 09:30:38
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 05:30:31.820079 2026] [security2:error] [pid 4330:tid 4330] [client 206.232.2.90:46017] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apk-N_ALAhFlk0XMpLuwAAAAAAs"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-09 16:43:59
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 12:43:50.513263 2026] [security2:error] [pid 3972653:tid 3972653] [client 206.232.2.90:58773] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cayman-islands-real-estate.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cayman-islands-real-estate.com"] [uri "/mailto:[email protected] "] [unique_id "aniuRn_-VwjoBOy04Vs7lAAAAAI"], referer: https://www.cayman-islands-real-estate.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 11:03:04
(2 months ago)
FortiWeb WAF: 12 attacks detected. Threat Score: 10859455. Types: Client Management(6), Signature De ...
show more
FortiWeb WAF: 12 attacks detected. Threat Score: 10859455. Types: Client Management(6), Signature Detection(6). Origin: United States.
show less
Web App Attack
2026-07-22 03:40:21
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 17:16:54
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 13:16:45.364738 2026] [security2:error] [pid 28415:tid 28415] [client 206.232.2.90:26111] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aib4_aAU24N6lPhPIFvcKQAAAJA"], referer: http://www.holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
dzpk
2026-04-23 23:21:08
(5 months ago)
206.232.2.90 - - [24/Apr/2026:01:21:07 +0200] "\x16\x03\x01\x01.\x01\x00\x01*\x03\x03\xA6\xB0\xD9o\x ...
show more
206.232.2.90 - - [24/Apr/2026:01:21:07 +0200] "\x16\x03\x01\x01.\x01\x00\x01*\x03\x03\xA6\xB0\xD9o\xE3\xCA\xB6m\x9D\xC2\xD3c\x18\x94\x1C[\x19H\xE7g\xE1\x08\xA7\xD0h&I\xF6*Y\xCB\xB9\x00\x00\xAC\xC00\xC0,\xC0(\xC0$\xC0\x14\xC0" 400 150 "-" "-"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-23 20:24:54
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 23 16:24:47.639554 2026] [security2:error] [pid 455:tid 455] [client 206.232.2.90:58543] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||HOLGERFELD.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "acGhjxDq02GDev62M925TwAAAAc"], referer: http://HOLGERFELD.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-09 12:36:18
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 09 07:36:12.764005 2026] [security2:error] [pid 29670:tid 29670] [client 206.232.2.90:35607] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aWD2PFjT559gEsfb8g5TPAAAABI"], referer: http://www.capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-23 10:42:35
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 23 05:42:28.587403 2025] [security2:error] [pid 10272:tid 10272] [client 206.232.2.90:25141] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.pharmaceuticalsalescertifications.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.pharmaceuticalsalescertifications.com"] [uri "/mailto:[email protected] "] [unique_id "aUpyFFm3Vuww6YMCnZX6qwAAAAc"], referer: http://www.pharmaceuticalsalescertifications.com
show less
Brute-Force
Bad Web Bot
Web App Attack
