🇩🇪
4server
2026-10-15 19:02:17
(4 days ago)
[ThuOct1521:02:14.8047422026][security2:error][pid176494:tid176580][client2400:cb00:21:1000:f94:8fcd ...
show more
[ThuOct1521:02:14.8047422026][security2:error][pid176494:tid176580][client2400:cb00:21:1000:f94:8fcd:fa83:65e6:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.eimeko.ch\"][uri\"/.aws/credentials\"][unique_id\"atEjNg5G81SejUVTcBzRjQAAAMc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 03:21:46
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 23:21:32.995872 2026] [security2:error] [pid 20643:tid 20643] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:12100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jerusalem-korczak-home.com"] [uri "/.env.local"] [unique_id "atBGvHlhET9gEsQqoE3e8gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 01:10:03
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 21:09:58.469564 2026] [security2:error] [pid 22264:tid 22264] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:11333] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lmjetservices.com"] [uri "/wp-config.php.old"] [unique_id "atAn5j4x6eAZrpgRYRs60AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-15 01:04:49
(5 days ago)
[ThuOct1503:04:46.2122412026][security2:error][pid3247043:tid3247176][client2400:cb00:21:1000:f94:8f ...
show more
[ThuOct1503:04:46.2122412026][security2:error][pid3247043:tid3247176][client2400:cb00:21:1000:f94:8fcd:fa83:65e6:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".backup\"][severity\"ERROR\"][hostname\"tcservices.ch\"][uri\"/.terraform/terraform.tfstate.backup\"][unique_id\"atAmrtwXezaUly0O9Nj-ZwAAAAg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 18:47:28
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:47:20.320418 2026] [security2:error] [pid 26438:tid 26438] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:12625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.indoorfreeflight.com"] [uri "/.env"] [unique_id "as_OOAy1kOt-lebGD50QTAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 18:09:29
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:09:25.574647 2026] [security2:error] [pid 30025:tid 30025] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:11589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kinnaird.enterprises"] [uri "/.htaccess"] [unique_id "as_FVaHH329D3XBEJERmVAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:17:51
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:17:44.386932 2026] [security2:error] [pid 26448:tid 26448] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:12376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yevid.com"] [uri "/.env.save"] [unique_id "as8QeDOG-_caMvRiV0HcLwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:25:21
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:25:10.600162 2026] [security2:error] [pid 11562:tid 11562] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:12194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.bordwell.com"] [uri "/.svn/entries"] [unique_id "as72Fg0L6LCQ5uZzePr8zAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:38:09
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:38:00.772990 2026] [security2:error] [pid 27452:tid 27452] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:10999] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stmaarten-boatcharters.com"] [uri "/wp-config.php.bak"] [unique_id "as7rCDPWCgYoeqy8jpJ8oAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:05:08
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:04:59.593676 2026] [security2:error] [pid 3137:tid 3137] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:9516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlehorneng.com"] [uri "/wp-config.php.bak"] [unique_id "as7HK1VApIvsoZSpTrQ4IQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:33:28
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:33:21.099603 2026] [security2:error] [pid 6040:tid 6040] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:11676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joevallone.com"] [uri "/.env.local"] [unique_id "as6_wQfSrXYx9mK7sly3XwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:41:18
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:41:07.332308 2026] [security2:error] [pid 10017:tid 10017] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:13766] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "belgiophar.com"] [uri "/wp-config.php.old"] [unique_id "as6zg54fXhRCnDzPmilumQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 18:35:33
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 14:35:30.258035 2026] [security2:error] [pid 1692:tid 1692] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:12775] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.vitaminpolis.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.vitaminpolis.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "as558pg4papCP_1wbLtf6wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 16:16:36
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 12:16:29.254421 2026] [security2:error] [pid 3944:tid 3944] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:10639] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robotrodeo.net"] [uri "/.env"] [unique_id "as5ZXa2GIPmvB5MBPk8_eQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 15:32:35
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:21:1000:f94:8fcd:fa83:65e6 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 11:32:31.366676 2026] [security2:error] [pid 25535:tid 25535] [client 2400:cb00:21:1000:f94:8fcd:fa83:65e6:13404] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.clientes.mpservice.com.sv|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "clientes.mpservice.com.sv"] [uri "/index.php.bak"] [unique_id "as5PD95tSbC1bIjVTySS9AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
