🇳🇱
Site.eu
2026-06-26 11:02:10
(4 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-06-26 03:23:02
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 23:22:56.387955 2026] [security2:error] [pid 3389:tid 3389] [client 2a04:c300:400::178:5924] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thewhoscountingband.tech-servusa.com"] [uri "/laravel/.env"] [unique_id "aj3wkJMqmewUPZorvtBg4wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
alferez
2026-06-25 22:21:21
(17 hours ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇩🇪
Hazzard
2026-06-25 21:19:22
(18 hours ago)
*Port Scan* detected from 2a04:c300:400::178 (US/United States/-/-/-/[redacted]).
Port Scan
🇺🇸
TPI-Abuse
2026-06-25 20:08:16
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 16:08:09.803082 2026] [security2:error] [pid 2828:tid 2828] [client 2a04:c300:400::178:36206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.musicalmuses.com"] [uri "/.env"] [unique_id "aj2KqQ5Vb8C7dXHtozHvxwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-25 13:59:50
(1 day ago)
(modsecurity) srv104 ModSecurity 2a04:c300:400::178 (DE/Germany/-): 10 in the last 3600 secs; Ports: ...
show more
(modsecurity) srv104 ModSecurity 2a04:c300:400::178 (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 13:47:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 09:47:25.501420 2026] [security2:error] [pid 7238:tid 7238] [client 2a04:c300:400::178:48146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.luxievintage.com"] [uri "/.env"] [unique_id "aj0xbVxO-w4fD3iCrAL4oQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 13:08:49
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 09:08:45.802440 2026] [security2:error] [pid 15943:tid 15943] [client 2a04:c300:400::178:17104] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coolgene.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coolgene.com"] [uri "/wp-content/debug.log"] [unique_id "aj0oXSY9Ta6zNBICx4ISWAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-06-25 07:57:24
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::178 (Unknown): N in the last X s ...
show more
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::178 (Unknown): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 07:11:16
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 03:11:08.695758 2026] [security2:error] [pid 16844:tid 16844] [client 2a04:c300:400::178:58848] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kulprid.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kulprid.com"] [uri "/wp-content/debug.log"] [unique_id "ajzUjEmO_PIZgs53__PguAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 06:48:25
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 02:48:18.100028 2026] [security2:error] [pid 12459:tid 12459] [client 2a04:c300:400::178:21696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.peonypeople.com"] [uri "/.env"] [unique_id "ajzPMr_v5LybNN655eHs1wAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-06-25 05:14:39
(1 day ago)
63 attacks on password grabbing URLs, env grabbing URLs, config grabbing URLs (type 2), VC URLs, too ...
show more
63 attacks on password grabbing URLs, env grabbing URLs, config grabbing URLs (type 2), VC URLs, too many concurrent requests:
GET /.aws/credentials HTTP/1.1
GET /.env.production.old HTTP/1.1
GET /config.json HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /gcp-service-account.json HTTP/1.1
show less
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-25 03:27:30
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::178 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 23:27:26.456871 2026] [security2:error] [pid 2734:tid 2734] [client 2a04:c300:400::178:55928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.juncurryahn.com"] [uri "/.env"] [unique_id "ajygHsJAfus0oAdvw1vYWQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
debaba
2026-06-25 01:58:56
(1 day ago)
[25/Jun/2026:01:58:54.957838 +0000] ajyLXgMQOvsjqrFOBthT-AAAAAU 2a04:c300:400::178 44896 127.0.0.1 7 ...
show more
[25/Jun/2026:01:58:54.957838 +0000] ajyLXgMQOvsjqrFOBthT-AAAAAU 2a04:c300:400::178 44896 127.0.0.1 7080
[25/Jun/2026:01:58:55.810549 +0000] ajyLX5w9fb
...
show less
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-06-25 01:22:26
(1 day ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 2a04:c300:400::178 (US/United States/-): ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 2a04:c300:400::178 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2a04:c300:400::178 - - [25/Jun/2026:03:22:20 +0200] "GET /.aws/credentials HTTP/1.1" 404 355 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" "-" host=mail.dimensioneautosgt.it
2a04:c300:400::178 - - [25/Jun/2026:03:22:20 +0200] "GET /secrets.json HTTP/1.1" 404 355 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "-" host=mail.dimensioneautosgt.it
show less
Port Scan