🇺🇸
TPI-Abuse
2026-10-16 03:35:33
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 23:35:27.159618 2026] [security2:error] [pid 16775:tid 16775] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 23:35:27.159618 2026] [security2:error] [pid 16775:tid 16775] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:11550] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bolivarbulletintimes.com"] [uri "/.env.bak"] [unique_id "atGbf0MKaD0Om2k_qt02WgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 12:03:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:03:11.675023 2026] [security2:error] [pid 27892:tid 27892] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:03:11.675023 2026] [security2:error] [pid 27892:tid 27892] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:11771] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chuckbellmusic.com"] [uri "/wp-config.php.save"] [unique_id "atDA_1qv0B04M51QvoGB5QAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 11:11:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:11:09.416480 2026] [security2:error] [pid 4062:tid 4062] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:11:09.416480 2026] [security2:error] [pid 4062:tid 4062] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:12974] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "partyblockinvitations.com"] [uri "/wp-config.php.save"] [unique_id "atC0zSLyfrxxIpnywo5ZLAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 01:52:00
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 21:51:53.014106 2026] [security2:error] [pid 16944:tid 16944] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 21:51:53.014106 2026] [security2:error] [pid 16944:tid 16944] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:10657] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.scermak.com"] [uri "/.env.bak"] [unique_id "atAxuSQXaoNd82gNYaMBdwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 04:38:52
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 00:38:45.174422 2026] [security2:error] [pid 13967:tid 13967] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 00:38:45.174422 2026] [security2:error] [pid 13967:tid 13967] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:12371] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.brazilianbottom.com"] [uri "/.env.bak"] [unique_id "as211Q1nZfGgnrflcTrK2AAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 03:28:00
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 23:27:48.149731 2026] [security2:error] [pid 13323:tid 13323] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 23:27:48.149731 2026] [security2:error] [pid 13323:tid 13323] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:9329] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uphillfarmvt.com"] [uri "/.git/HEAD"] [unique_id "as2lNJ1nC8gKCOzWUGj_uwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 01:52:40
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 21:52:31.851618 2026] [security2:error] [pid 5052:tid 5052] [c ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 21:52:31.851618 2026] [security2:error] [pid 5052:tid 5052] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:13080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||phoneresponse.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "phoneresponse.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "as2O3wJ_CblHh3WcAfzMRwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-13 00:10:59
(2 weeks ago)
[TueOct1302:10:53.1291662026][security2:error][pid298001:tid298127][client2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\) ...
show more
[TueOct1302:10:53.1291662026][security2:error][pid298001:tid298127][client2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"rvengineering.ch\"][uri\"/.env\"][unique_id\"as13DQSP6Cw62iUU7Z_PBQAAAQo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
todix
2026-10-12 10:15:40
(2 weeks ago)
"GET /.env.backup HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
Brute-Force
🇺🇸
TPI-Abuse
2026-10-12 06:54:34
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 02:54:28.533131 2026] [security2:error] [pid 12425:tid 12425] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 02:54:28.533131 2026] [security2:error] [pid 12425:tid 12425] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:12306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arcadiapropertiesllc.com"] [uri "/.env.save"] [unique_id "asyEJDU4byAPAYptNwgOHQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 17:05:20
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 13:05:14.867764 2026] [security2:error] [pid 7677:tid 7677] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 13:05:14.867764 2026] [security2:error] [pid 7677:tid 7677] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:10286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apsni.net"] [uri "/.env.backup"] [unique_id "askeyo0xEK1cyj7G5kxebwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 16:30:21
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:30:15.658376 2026] [security2:error] [pid 27012:tid 27028] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:30:15.658376 2026] [security2:error] [pid 27012:tid 27028] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:10077] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "doorways.info"] [uri "/.env.production"] [unique_id "askWl-q17XvJ786TWxGpOgAAAM4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 15:28:25
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 11:28:19.561976 2026] [security2:error] [pid 26015:tid 26015] ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 11:28:19.561976 2026] [security2:error] [pid 26015:tid 26015] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:13994] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||furballaudio.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "furballaudio.com"] [uri "/index.php.bak"] [unique_id "askIE5EV0PoD7Txb49joFwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Bensay
2026-10-08 16:16:22
(2 weeks ago)
HTTP web-app probe; method=GET; path=/.env.save; status=403; user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 11:13:36
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 07:13:33.371159 2026] [security2:error] [pid 6621:tid 6621] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 07:13:33.371159 2026] [security2:error] [pid 6621:tid 6621] [client 2400:cb00:20:1000:a2b1:5c2c:6add:f2cd:10990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "periodthreads.com"] [uri "/wp-config.php.bak"] [unique_id "asd63RVsT9oa33-1u4VxagAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
