🇺🇸
TPI-Abuse
2026-10-14 01:30:11
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:30:03.535804 2026] [security2:error] [pid 22615:tid 22615] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:11344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nuewines.com"] [uri "/wp-config.php.bak"] [unique_id "as7bG0C3jXdrx8Ptl8WjtgAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 17:38:45
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 13:38:39.639742 2026] [security2:error] [pid 20213:tid 20317] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:13626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oftv.xyz"] [uri "/.env.dev"] [unique_id "as5sn6-bmiTFslbVlvARaQAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 10:25:28
(17 hours ago)
(mod_security) mod_security (id:949110) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:949110) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 06:25:23.345216 2026] [security2:error] [pid 29286:tid 29286] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:10025] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "pleasejustfixit.org"] [uri "/wp-config.php.old"] [unique_id "as4HE1pir_PSi8QN9rsTigAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 05:13:05
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:12:57.485946 2026] [security2:error] [pid 30826:tid 30826] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:12066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "satanisdead.com"] [uri "/wp-config.php.save"] [unique_id "as292UpT_EWgODQNUa-TCQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 20:02:46
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 16:02:40.661418 2026] [security2:error] [pid 19032:tid 19032] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:13273] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||apuntesdeinversion.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "apuntesdeinversion.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "asvrYBnsUltpuiGdC7YLLAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 18:50:10
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:50:04.569556 2026] [security2:error] [pid 10701:tid 10701] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:13802] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||jellisonrepair.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jellisonrepair.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "asvaXFe0bV5v6jwiCRXZQwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 16:01:34
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 12:01:29.407736 2026] [security2:error] [pid 10955:tid 10955] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:13201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myllc.email"] [uri "/.env.save"] [unique_id "asuy2VVsw_eUrFUG7cqjjwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 13:47:21
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 09:47:17.187095 2026] [security2:error] [pid 11272:tid 11272] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:12532] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||notariaramirez.cl|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "notariaramirez.cl"] [uri "/index.php.bak"] [unique_id "asuTZRLFHSjI7JqH6LBqcAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-11 10:24:11
(2 days ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 - - [11/Oct/2026:12:24:09 +0200] "GET /.svn/entries HTTP/1.1" 301 493 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:58:25
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:58:19.276621 2026] [security2:error] [pid 15854:tid 15854] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:10301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.acquivest.net"] [uri "/wp-config.php.bak"] [unique_id "asrtOxINRRbHekgpEpZD6AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 21:08:11
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 17:08:06.150309 2026] [security2:error] [pid 22858:tid 22858] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:10979] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pamplonaserviciotecnico.com"] [uri "/.svn/entries"] [unique_id "asqpNnF0ZWlbAi9VRMmydgAAAC8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 18:30:14
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 14:30:07.501962 2026] [security2:error] [pid 23810:tid 23810] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:12107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.davidfortier.com"] [uri "/wp-config.php.bak"] [unique_id "asqEL5xZNQlrdK6CnscNWwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 12:24:25
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 08:24:20.032534 2026] [security2:error] [pid 7850:tid 7850] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:14223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.snowfection.com"] [uri "/.env"] [unique_id "asoudGWoLaA2MycSsm7cHgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 23:35:17
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210730) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 19:35:07.842770 2026] [security2:error] [pid 32386:tid 32386] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:10740] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.starcrestsales.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.starcrestsales.com"] [uri "/.terraform/terraform.tfstate.backup"] [unique_id "asl6K_CYOTuKgjWI5ac58wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 08:30:17
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown ...
show more
(mod_security) mod_security (id:210492) triggered by 2400:cb00:996:1000:caab:f8e7:8da2:dfe5 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 04:30:11.781477 2026] [security2:error] [pid 7685:tid 7685] [client 2400:cb00:996:1000:caab:f8e7:8da2:dfe5:13098] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.tjss.ac.cy"] [uri "/.env"] [unique_id "asimE-Ier6FL2VZf4UjfbAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
