🇺🇸
TPI-Abuse
2026-10-12 01:11:09
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:11:05.051991 2026] [security2:error] [pid 2645:tid 2656] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:14010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "annefraser.com"] [uri "/.env"] [unique_id "aswzqco0pg3kbBdxIVYfZwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 19:25:22
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 15:25:17.717803 2026] [security2:error] [pid 12741:tid 12741] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:13248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kewlkarz.com"] [uri "/.env.old"] [unique_id "asvinWq2BdIILGPUFLA8WAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 20:07:34
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 16:07:30.657654 2026] [security2:error] [pid 21136:tid 21136] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:10279] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||abraxasstudio.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "abraxasstudio.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "asqbAoJ79ZqvlYF9rzb9UAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-09 21:59:18
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-08.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-10-09 13:44:49
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 09:44:43.285494 2026] [security2:error] [pid 24609:tid 24609] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:14035] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "muddypuddy.com"] [uri "/.env.local"] [unique_id "asjvy7_oZmNNPm6D86fyOAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 09:25:36
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 05:25:31.867541 2026] [security2:error] [pid 9135:tid 9135] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:9542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cynthiabaxter.com"] [uri "/wp-config.php.bak"] [unique_id "asizC9U_NVeZzsFfavEyCwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 04:43:49
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 00:43:41.532617 2026] [security2:error] [pid 23497:tid 23497] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:9799] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mymclife.com"] [uri "/.env.local"] [unique_id "ashw_XCIlEGUcCph3dAjgwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:39:40
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:39:36.671237 2026] [security2:error] [pid 6906:tid 6906] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:14135] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||humans2humans.org|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "humans2humans.org"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "ashF2NZ1wCEqyWmhcVlkCQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 18:17:45
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 14:17:25.853144 2026] [security2:error] [pid 28141:tid 28141] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:14014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "syscomprint.com"] [uri "/.git/HEAD"] [unique_id "asfeNYkjpZb8VMJFpD4scQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 14:36:49
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:36:40.417861 2026] [security2:error] [pid 21541:tid 21541] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:9922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webersource.com"] [uri "/.env.backup"] [unique_id "aseqeH9Q8fENiiX0v3JWaAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 14:12:59
(3 days ago)
(mod_security) mod_security (id:949110) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:949110) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:12:54.499551 2026] [security2:error] [pid 4954:tid 4954] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:12697] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunstrongmetal.com"] [uri "/.svn/entries"] [unique_id "asek5lB7PGWlRo9JJJDhLQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 07:55:10
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 03:55:00.572400 2026] [security2:error] [pid 29987:tid 29987] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:11906] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grupoimaginarte.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grupoimaginarte.com"] [uri "/index.php.bak"] [unique_id "asdMVLCD9JKy4ZESF0NsSgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-08 07:31:56
(3 days ago)
[ThuOct0809:31:51.8903142026][security2:error][pid2049835:tid2049899][client2400:cb00:21:1000:ab4d:a ...
show more
[ThuOct0809:31:51.8903142026][security2:error][pid2049835:tid2049899][client2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"noleggi.ch\"][uri\"/wp-config.php.bak\"][unique_id\"asdG52iadblBG7L8dJvGYQAAAIA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇨🇭
4server
2026-10-07 20:26:13
(4 days ago)
[WedOct0722:26:07.2311672026][security2:error][pid83599:tid83615][client2400:cb00:21:1000:ab4d:aaa:e ...
show more
[WedOct0722:26:07.2311672026][security2:error][pid83599:tid83615][client2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"4hosts.net\"][uri\"/.env\"][unique_id\"asaq3_LSMpmNrhelD3twBAAAAAw\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 19:40:38
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 15:40:31.718329 2026] [security2:error] [pid 25688:tid 25688] [client 2400:cb00:21:1000:ab4d:aaa:eaca:1bd9:11958] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.zezel.com"] [uri "/.env.bak"] [unique_id "asagL7-s1Q18ih6W27T9QAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
