🇳🇱
homeshowdomain.nl
2026-06-24 22:02:03
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-23.
show less
Web App Attack
SSH
Hacking
2026-06-24 12:05:08
(2 days ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 11:09:21
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 07:09:14.795795 2026] [security2:error] [pid 6865:tid 6865] [client 2a04:c300:400::17d:63840] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.madkatty.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.madkatty.com"] [uri "/wp-content/debug.log"] [unique_id "aju62m3UGIyOU3g_iMTteAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 10:28:47
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 06:28:41.110334 2026] [security2:error] [pid 28290:tid 28290] [client 2a04:c300:400::17d:19398] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.garysgates.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.garysgates.com"] [uri "/wp-content/debug.log"] [unique_id "ajuxWZGQT7cbN4dCRm35EgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 08:14:13
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 04:14:05.593208 2026] [security2:error] [pid 22863:tid 22863] [client 2a04:c300:400::17d:33238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.p-co.com"] [uri "/.env"] [unique_id "ajuRzTy2ViGMwkDkQOaQNgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 01:51:27
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 21:51:21.298001 2026] [security2:error] [pid 5126:tid 5126] [client 2a04:c300:400::17d:12428] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.hazelwerner.com"] [uri "/web/.env"] [unique_id "ajs4GcniPaPTIpA0NSMHNAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 00:02:54
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 20:02:47.614555 2026] [security2:error] [pid 15308:tid 15345] [client 2a04:c300:400::17d:37066] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||maestrosoler.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "maestrosoler.com"] [uri "/wp-content/debug.log"] [unique_id "ajsepyuTSQwM9VXsnrv27gAAAYU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-23 19:56:28
(2 days ago)
(modsecurity) srv103 ModSecurity 2a04:c300:400::17d (DE/Germany/-): 10 in the last 3600 secs; Ports: ...
show more
(modsecurity) srv103 ModSecurity 2a04:c300:400::17d (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 18:24:24
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:24:20.208341 2026] [security2:error] [pid 7731:tid 7731] [client 2a04:c300:400::17d:40032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.robhoward.me"] [uri "/.env.save"] [unique_id "ajrPVAwJ7aqRVu-2SkBdogAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 17:34:24
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 13:34:18.235486 2026] [security2:error] [pid 1833:tid 1833] [client 2a04:c300:400::17d:45344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.twtcsl.com"] [uri "/src/.env"] [unique_id "ajrDmqbH8-Ttdku6tO9d_gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 16:17:42
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 12:17:36.839699 2026] [security2:error] [pid 21637:tid 21637] [client 2a04:c300:400::17d:7068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.uppercervicaloc.daebakdesign.com"] [uri "/web/.env"] [unique_id "ajqxoGoJj-LHHoO2qde0dQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-06-23 14:53:52
(3 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-06-23 14:38:25
(3 days ago)
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::17d (Unknown): N in the last X s ...
show more
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::17d (Unknown): N in the last X secs
show less
Web App Attack
🇩🇪
4server
2026-06-23 14:27:10
(3 days ago)
[TueJun2316:27:06.6356672026][security2:error][pid3016854:tid3016997][client2a04:c300:400::17d:0]Mod ...
show more
[TueJun2316:27:06.6356672026][security2:error][pid3016854:tid3016997][client2a04:c300:400::17d:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"akastudio.ch\"][uri\"/wp-content/debug.log\"][unique_id\"ajqXujL3lJK2RhFa_htYxwAAAQQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 14:11:31
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::17d (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 10:11:23.494914 2026] [security2:error] [pid 3381:tid 3381] [client 2a04:c300:400::17d:26502] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.musiclipsapp.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.musiclipsapp.com"] [uri "/wp-content/debug.log"] [unique_id "ajqUCxKU9KHe4RoIBhn7RgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack