🇺🇸
TPI-Abuse
2026-10-15 23:26:22
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:26:16.039916 2026] [security2:error] [pid 28221:tid 28221] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 19:26:16.039916 2026] [security2:error] [pid 28221:tid 28221] [client 2400:cb00:555:1000:a19c:7417:c978:398b:13808] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "grayowl.com"] [uri "/.htaccess"] [unique_id "atFhGItXoKT1C8UAe5tpTAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 21:17:22
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:949110) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 17:17:17.157554 2026] [security2:error] [pid 9307:tid 9307] [ ...
show more
(mod_security) mod_security (id:949110) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 17:17:17.157554 2026] [security2:error] [pid 9307:tid 9307] [client 2400:cb00:555:1000:a19c:7417:c978:398b:9560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "radiographer.info"] [uri "/.env.old"] [unique_id "atFC3UgA7zRIHq6zNFViBQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 22:23:05
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 18:23:01.605256 2026] [security2:error] [pid 26602:tid 26602] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 18:23:01.605256 2026] [security2:error] [pid 26602:tid 26602] [client 2400:cb00:555:1000:a19c:7417:c978:398b:13834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clubfansite.com"] [uri "/.env.staging"] [unique_id "atAAxeu0FUDXvo3NAUkrPgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 21:41:42
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 17:41:38.995056 2026] [security2:error] [pid 21721:tid 21721] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 17:41:38.995056 2026] [security2:error] [pid 21721:tid 21721] [client 2400:cb00:555:1000:a19c:7417:c978:398b:14244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "redlitephotos.com"] [uri "/wp-config.php.save"] [unique_id "as_3EjlE2UBRI8I3zCcutgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 14:21:19
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 10:21:10.493938 2026] [security2:error] [pid 5410:tid 5410] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 10:21:10.493938 2026] [security2:error] [pid 5410:tid 5410] [client 2400:cb00:555:1000:a19c:7417:c978:398b:11648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.arofish.us"] [uri "/.env"] [unique_id "as-P1nsxNAO62tT5ctRjfgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:41:33
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:41:29.905280 2026] [security2:error] [pid 31457:tid 31457] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:41:29.905280 2026] [security2:error] [pid 31457:tid 31457] [client 2400:cb00:555:1000:a19c:7417:c978:398b:11301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nathanburd.com"] [uri "/.env.staging"] [unique_id "as7PueWkgez9EQk7zcxdnwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 08:33:07
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:32:53.219865 2026] [security2:error] [pid 30622:tid 30622] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:32:53.219865 2026] [security2:error] [pid 30622:tid 30622] [client 2400:cb00:555:1000:a19c:7417:c978:398b:13944] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "limosnapa.com"] [uri "/.git/HEAD"] [unique_id "as3staek6JUfhiG_CSo-DwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 05:07:05
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:06:57.715836 2026] [security2:error] [pid 31437:tid 31437] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:06:57.715836 2026] [security2:error] [pid 31437:tid 31437] [client 2400:cb00:555:1000:a19c:7417:c978:398b:10334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "morninginc.com"] [uri "/.htaccess"] [unique_id "as28cZ9_O4zBGaczZHfCcQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 02:45:52
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:45:45.652674 2026] [security2:error] [pid 26965:tid 26965] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 22:45:45.652674 2026] [security2:error] [pid 26965:tid 26965] [client 2400:cb00:555:1000:a19c:7417:c978:398b:10842] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "grmvrr.com"] [uri "/.env.old"] [unique_id "as2bWZ7BDzQwNPTjH0sqmgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 22:35:58
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 18:35:52.162226 2026] [security2:error] [pid 31462:tid 31462] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 18:35:52.162226 2026] [security2:error] [pid 31462:tid 31462] [client 2400:cb00:555:1000:a19c:7417:c978:398b:10091] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "torresyrellenos.com"] [uri "/.env.backup"] [unique_id "as1gyCboUAp8mL3zel7soAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 05:27:37
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:27:29.584609 2026] [security2:error] [pid 9014:tid 9014] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:27:29.584609 2026] [security2:error] [pid 9014:tid 9014] [client 2400:cb00:555:1000:a19c:7417:c978:398b:11724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oakleighfarm.com"] [uri "/.env.old"] [unique_id "asxvwfV6UoBhgqw1COyITwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-11 23:20:24
UTC ·
(3 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-11 23:16:44
UTC ·
(3 weeks ago)
2400:cb00:555:1000:a19c:7417:c978:398b - - [12/Oct/2026:01:16:11 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 591 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
2400:cb00:555:1000:a19c:7417 ...
show more
2400:cb00:555:1000:a19c:7417:c978:398b - - [12/Oct/2026:01:16:11 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 591 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
2400:cb00:555:1000:a19c:7417:c978:398b - - [12/Oct/2026:01:16:08 +0200] "GET /.npmrc HTTP/1.1" 301 569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
2400:cb00:555:1000:a19c:7417:c978:398b - - [12/Oct/2026:01:16:08 +0200] "GET /.docker/config.json HTTP/1.1" 301 595 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1"
2400:cb00:555:1000:a19c:7417:c978:398b - - [12/Oct/2026:01:16:08 +0200] "GET /.env.production HTTP/1.1" 301 587 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1"
2400:cb00:555:1000:a19c:741
show less
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-11 13:54:39
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 09:54:31.087973 2026] [security2:error] [pid 9355:tid 9355] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 09:54:31.087973 2026] [security2:error] [pid 9355:tid 9355] [client 2400:cb00:555:1000:a19c:7417:c978:398b:9553] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathyquan.com"] [uri "/.env.bak"] [unique_id "asuVF7GWEiYkRsNDbl6zswAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 10:43:52
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 06:43:45.254052 2026] [security2:error] [pid 18897:tid 19003] ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:555:1000:a19c:7417:c978:398b (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 06:43:45.254052 2026] [security2:error] [pid 18897:tid 19003] [client 2400:cb00:555:1000:a19c:7417:c978:398b:9221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "frannykingsmith.com"] [uri "/.env.backup"] [unique_id "astoYXadqdSCakdnv6QQPQAAAdE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
