🇩🇪
R.G.
2026-06-26 10:17:25
(6 hours ago)
(CT) IP 2a04:c300:400::176 (Unknown) found to have 223 connections; Ports: *; Direction: inout; Trig ...
show more
(CT) IP 2a04:c300:400::176 (Unknown) found to have 223 connections; Ports: *; Direction: inout; Trigger: CT_LIMIT; Logs:
show less
DDoS Attack
🇺🇸
TPI-Abuse
2026-06-26 03:16:41
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 23:16:36.507031 2026] [security2:error] [pid 29981:tid 29981] [client 2a04:c300:400::176:45370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.delucchi.net"] [uri "/public/.env"] [unique_id "aj3vFGtxrjFOpVGMAaoWpwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-26 01:33:39
(15 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
updown.io
2026-06-25 23:30:28
(17 hours ago)
{"level":"info","ts":1782428421.853025,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1782428421.853025,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"2a04:c300:400::176","remote_port":"15042","client_ip":"2a04:c300:400::176","proto":"HTTP/1.1","method":"GET","host":"status.gunnerstoday.com","uri":"/","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0"]}},"bytes_read":0,"user_id":"","duration":0.000106024,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.gunnerstoday.com/"],"Content-Type":[]}}
{"level":"info","ts":1782430216.254914,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"2a04:c300:400::176","remote_port":"35144","client_ip":"2a04:c300:400::176","proto":"HTTP/1.1","method":"GET","host":"status.steeve.eu","uri":"/","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64;
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 23:25:15
(17 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 19:25:08.002090 2026] [security2:error] [pid 12749:tid 12749] [client 2a04:c300:400::176:33930] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||herbertwmason.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "herbertwmason.com"] [uri "/wp-content/debug.log"] [unique_id "aj2406kuAutJLLvyrd8EBQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 19:07:44
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 15:07:36.993269 2026] [security2:error] [pid 1087:tid 1087] [client 2a04:c300:400::176:50126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.muebleriamac.com"] [uri "/.env"] [unique_id "aj18eK7mXVjBsaju1Hj42wAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 18:02:39
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 14:02:34.097597 2026] [security2:error] [pid 15777:tid 15777] [client 2a04:c300:400::176:21626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kennedimoore.click"] [uri "/src/.env"] [unique_id "aj1tOvSdqys6vCWqC_-yCgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 15:36:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 11:36:37.310366 2026] [security2:error] [pid 16454:tid 16454] [client 2a04:c300:400::176:55108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.brookspowell.com"] [uri "/.env"] [unique_id "aj1LBZB70LFukJBIVT366gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 15:06:20
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 11:06:14.817113 2026] [security2:error] [pid 15276:tid 15276] [client 2a04:c300:400::176:30756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.globalmonitoringinc.com"] [uri "/api/.env"] [unique_id "aj1D5tQmCwDEN6K34_Z7xgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 14:10:56
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 10:10:52.006954 2026] [security2:error] [pid 31767:tid 31767] [client 2a04:c300:400::176:27826] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.cybersoftware.org|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.cybersoftware.org"] [uri "/wp-content/debug.log"] [unique_id "aj027CdL1xAsQ5lcwe07uQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 13:23:23
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 09:23:17.814097 2026] [security2:error] [pid 11486:tid 11486] [client 2a04:c300:400::176:58478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.cayman-islands-real-estate.com"] [uri "/.env.development"] [unique_id "aj0rxSiclXsgb91gDKnhnAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 10:04:41
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 06:04:37.010046 2026] [security2:error] [pid 27096:tid 27096] [client 2a04:c300:400::176:24796] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aquadom.aguasolar.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aquadom.aguasolar.com"] [uri "/wp-content/debug.log"] [unique_id "ajz9NTRGkjiiwQkdDo1CWgAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 07:20:06
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 03:20:01.613769 2026] [security2:error] [pid 21730:tid 21730] [client 2a04:c300:400::176:54974] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.tinseltownartificials.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.tinseltownartificials.com"] [uri "/wp-content/debug.log"] [unique_id "ajzWobXk5YPIuX5XYgmbGgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-25 06:13:17
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 05:01:00
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::176 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 01:00:56.404613 2026] [security2:error] [pid 28789:tid 28789] [client 2a04:c300:400::176:32676] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.burningdownthevillger.com.tremulant.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "burningdownthevillger.com.tremulant.com"] [uri "/wp-content/debug.log"] [unique_id "ajy2CDJhiZN6Ebopmo9LIAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack