🇩🇪
4server
2026-10-15 02:42:04
(1 day ago)
[ThuOct1504:41:56.9279012026][security2:error][pid3329759:tid3329862][client2400:cb00:555:1000:9c1:3 ...
show more
[ThuOct1504:41:56.9279012026][security2:error][pid3329759:tid3329862][client2400:cb00:555:1000:9c1:3d88:a6f0:caa:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:id_\(\?:r\|d\)sa\$\|key\\\\\\\\.pem\$\|\(\?:myserver\|private-\?key\)\\\\\\\\.key\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1185\"][id\"350591\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessrawPrivatecrytokeys\"][severity\"CRITICAL\"][hostname\"creazione-siti-web-ticino.ch\"][uri\"/.ssh/id_rsa\"][unique_id\"atA9dGjQQeZKH_zYJeY3-AAAAcU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 23:02:02
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:01:56.428525 2026] [security2:error] [pid 22341:tid 22341] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:12498] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.grampys.toys"] [uri "/.env.staging"] [unique_id "atAJ5IYPebNzI62NOQlz4AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 19:32:25
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 15:32:17.096289 2026] [security2:error] [pid 25389:tid 25486] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:10528] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "executive.bz"] [uri "/.env.bak"] [unique_id "as_YwX8R1V2fiOXTocJ0XAAAARY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 16:48:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:48:22.677863 2026] [security2:error] [pid 24162:tid 24162] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:11879] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dishoneggs.com"] [uri "/.env.old"] [unique_id "as-yVtuZLQ_zt36hmziMMwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 15:16:32
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 11:16:26.826912 2026] [security2:error] [pid 21550:tid 21550] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:13422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caferutadelaseda.com"] [uri "/.git/HEAD"] [unique_id "as-cyoFCgv6DNyed6OwlsAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-14 13:31:48
(1 day ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2400:cb00:555:1000:9c1:3d88:a6f0:caa - - [14/Oct/2026:15:31:32 +0200] "GET /.env.backup HTTP/1.1" 301 499 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:43:22
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:43:13.737568 2026] [security2:error] [pid 31908:tid 31908] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:10119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.suffe.cool|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.suffe.cool"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "as8WcWZIUBZY_4IQ8k2IuQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:40:46
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:40:32.916449 2026] [security2:error] [pid 8614:tid 8614] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:10638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ferienwohnungen-eva.at"] [uri "/wp-config.php.save"] [unique_id "as6zYBfDYnjy_LTpvZii-wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 10:29:41
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:29:35.455324 2026] [security2:error] [pid 23675:tid 23675] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:9223] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||spacerecording.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "spacerecording.com"] [uri "/index.php.bak"] [unique_id "as4ID0A66SEFXe0W_wRuVAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 01:14:32
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 21:14:23.682855 2026] [security2:error] [pid 27090:tid 27090] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:13862] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trimandtend.com"] [uri "/.env.bak"] [unique_id "as2F754zWmKrSOkFSH4iHAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 05:29:47
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:29:41.787553 2026] [security2:error] [pid 32218:tid 32218] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:13371] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.americanexportimport.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.americanexportimport.com"] [uri "/index.php.bak"] [unique_id "asxwRSlU9NY5WD08Nwq7RQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-12 01:16:28
(4 days ago)
[MonOct1203:16:22.4856332026][security2:error][pid3135249:tid3135345][client2400:cb00:555:1000:9c1:3 ...
show more
[MonOct1203:16:22.4856332026][security2:error][pid3135249:tid3135345][client2400:cb00:555:1000:9c1:3d88:a6f0:caa:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"shaping.ch\"][uri\"/wp-config.php.old\"][unique_id\"asw05n43EkLWykaDZAGvEgAAAMU\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 13:13:44
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 09:13:39.222267 2026] [security2:error] [pid 32597:tid 32597] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:10545] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.seads.global"] [uri "/wp-config.php.bak"] [unique_id "asuLgzcOcMcoyf20Z8rb-gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 12:19:29
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 08:19:26.997708 2026] [security2:error] [pid 12371:tid 12371] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:11336] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "assembliesofgodinsamoa.org"] [uri "/.env.production"] [unique_id "ast-zha779PLidFUTPsi2wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 15:30:20
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:9c1:3d88:a6f0:caa (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 11:29:55.861786 2026] [security2:error] [pid 29156:tid 29156] [client 2400:cb00:555:1000:9c1:3d88:a6f0:caa:12000] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.smokehouseeatery.ca"] [uri "/.env.bak"] [unique_id "askIcxnKzpyBDbSmSe2N4gAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
