2026-02-15 16:31:11
(3 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇫🇷
dynamix
2026-02-15 12:19:27
(3 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
mnsf
2026-02-15 06:05:59
(3 months ago)
Scanning/Probing (25)
Brute-Force
Web App Attack
2026-02-15 06:00:23
(3 months ago)
209.50.176.17 - - [15/Feb/2026:07:00:22 +0100] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 ...
show more
209.50.176.17 - - [15/Feb/2026:07:00:22 +0100] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
show less
Web App Attack
🇨🇭
Origon
2026-02-15 05:01:33
(3 months ago)
http-sensitive-files - IP: 209.50.176.17 - time="2026-02-15T06:01:33+01:00" level=info msg="(555f66 ...
show more
http-sensitive-files - IP: 209.50.176.17 - time="2026-02-15T06:01:33+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 209.50.176.17 (BR/200373) : 4h ban on Ip 209.50.176.17" module=db
show less
Web App Attack
🇬🇧
consul.to
2026-02-15 01:12:21
(3 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2025-12-30 12:22:41
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 07:21:58.209068 2025] [security2:error] [pid 12606:tid 12606] [client 209.50.176.17:26983] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.trafficstopper.com"] [uri "/.svn/wc.db"] [unique_id "aVPD5tbctXB7-1OY84Gw_QAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 09:01:43
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 04:01:36.844496 2025] [security2:error] [pid 8381:tid 8381] [client 209.50.176.17:37927] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "billyclouse.com"] [uri "/.git/HEAD"] [unique_id "aVJDcL3zjnx6ucsxc8sQ_AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 08:07:15
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 03:07:09.662055 2025] [security2:error] [pid 1729:tid 1729] [client 209.50.176.17:31577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "innovacionesnimba.com"] [uri "/.svn/wc.db"] [unique_id "aVI2rcIa0UMWIE2HRXANUwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 05:29:54
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:29:48.303700 2025] [security2:error] [pid 3589:tid 3589] [client 209.50.176.17:34469] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cbsproductionsinc.com"] [uri "/.git/HEAD"] [unique_id "aVIRzJaAjJafYxON8j-0NAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 04:25:53
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 23:25:48.168926 2025] [security2:error] [pid 22515:tid 22515] [client 209.50.176.17:40253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "billdavidow.com"] [uri "/.git/HEAD"] [unique_id "aVICzBZnPrk0o-hNRMuc4QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 21:45:01
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 16:44:52.867914 2025] [security2:error] [pid 11757:tid 11757] [client 209.50.176.17:32239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelgatley.com"] [uri "/.svn/wc.db"] [unique_id "aS9d1LqgvqgSom73ohajsQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 20:01:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 15:01:30.399733 2025] [security2:error] [pid 6986:tid 6986] [client 209.50.176.17:28895] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "surrenderhouse.com"] [uri "/.env"] [unique_id "aS9Fmml4clzmXsKTSLRtugAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 16:52:15
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 11:52:10.324864 2025] [security2:error] [pid 22363:tid 22363] [client 209.50.176.17:26165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gunningphysio.com"] [uri "/.env"] [unique_id "aS8ZOmtLIq1F1EwuFxWwlQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 15:34:18
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.176.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 10:34:11.437854 2025] [security2:error] [pid 6808:tid 6808] [client 209.50.176.17:19661] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "statisticsvideos.com"] [uri "/.env"] [unique_id "aS8G81szclAhD6irUlhuDgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack