🇺🇸
TPI-Abuse
2026-06-23 09:54:46
(18 minutes ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 05:54:40.147591 2026] [security2:error] [pid 11967:tid 11967] [client 2a04:c300:400::181:41124] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||southernstatespool.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "southernstatespool.com"] [uri "/wp-content/debug.log"] [unique_id "ajpX4OezXqZY3IHs7TGOhwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 09:36:59
(36 minutes ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 05:36:52.318943 2026] [security2:error] [pid 24137:tid 24137] [client 2a04:c300:400::181:28610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.djbadger.com"] [uri "/.env.backup"] [unique_id "ajpTtNc3BrIwwz9ktFzo8gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 09:03:46
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 05:03:43.150356 2026] [security2:error] [pid 28401:tid 28401] [client 2a04:c300:400::181:37118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sneedvillefarmersmarket.com"] [uri "/.env"] [unique_id "ajpL76vrQqLpX1ja0qwwfQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
seal
2026-06-23 07:52:43
(2 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
SSH
Brute-Force
🇳🇱
Site.eu
2026-06-23 07:30:17
(2 hours ago)
Excessive multi-domain requests
Brute-Force
🇪🇸
alferez
2026-06-23 07:11:17
(3 hours ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 07:09:55
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 03:09:50.510719 2026] [security2:error] [pid 16639:tid 16639] [client 2a04:c300:400::181:14544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.agapeaccounting.com"] [uri "/.env.production"] [unique_id "ajoxPvknvVjhZvg3XqsQAQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
debaba
2026-06-23 06:44:11
(3 hours ago)
[23/Jun/2026:06:44:10.387441 +0000] ajorOsdHEndsvbYdSgoCfgAAAFQ 2a04:c300:400::181 34166 127.0.0.1 7 ...
show more
[23/Jun/2026:06:44:10.387441 +0000] ajorOsdHEndsvbYdSgoCfgAAAFQ 2a04:c300:400::181 34166 127.0.0.1 7080
[23/Jun/2026:06:44:11.087678 +0000] ajorO8dHEn
...
show less
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-06-23 06:19:56
(3 hours ago)
2a04:c300:400::181 - - [23/Jun/2026:09:19:53 +0300] "GET /wp-content/debug.log HTTP/1.1" 404 733 "-" ...
show more
2a04:c300:400::181 - - [23/Jun/2026:09:19:53 +0300] "GET /wp-content/debug.log HTTP/1.1" 404 733 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
2a04:c300:400::181 - - [23/Jun/2026:09:19:54 +0300] "GET /.env HTTP/1.1" 404 733 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 05:55:31
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:55:27.631932 2026] [security2:error] [pid 9467:tid 9467] [client 2a04:c300:400::181:46174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.accordionclub.org"] [uri "/.env"] [unique_id "ajofz-ks3As58zPpfwnBwAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
LRob.fr
2026-06-23 05:45:02
(4 hours ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 05:28:05
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:27:56.694885 2026] [security2:error] [pid 12055:tid 12055] [client 2a04:c300:400::181:25188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.gildemello.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.gildemello.com"] [uri "/wp-content/debug.log"] [unique_id "ajoZXIM-R9vNgfO8ayvJHAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-23 05:27:22
(4 hours ago)
(modsecurity) srv201 ModSecurity 2a04:c300:400::181 (DE/Germany/-): 10 in the last 3600 secs; Ports: ...
show more
(modsecurity) srv201 ModSecurity 2a04:c300:400::181 (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 05:04:01
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:03:58.202343 2026] [security2:error] [pid 17424:tid 17424] [client 2a04:c300:400::181:42966] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||costaricaencasa.galvez.cc|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "costaricaencasa.galvez.cc"] [uri "/wp-content/debug.log"] [unique_id "ajoTvkIt3rNmcXdGzV4WWwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 04:46:05
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::181 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 00:45:58.975825 2026] [security2:error] [pid 29782:tid 29782] [client 2a04:c300:400::181:43348] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.matrixpercussiontrio.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.matrixpercussiontrio.com"] [uri "/wp-content/debug.log"] [unique_id "ajoPhma4sCcMRHPseTnJXAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack