🇺🇸
TPI-Abuse
2026-06-22 23:15:32
(14 minutes ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 19:15:25.462187 2026] [security2:error] [pid 15119:tid 15119] [client 2a04:c300:400::185:35158] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ipv6.samanthasomers.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ipv6.samanthasomers.com"] [uri "/wp-content/debug.log"] [unique_id "ajnCDYWFZzhwoTFhZpC90gAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-22 23:08:20
(21 minutes ago)
(modsecurity) srv102 ModSecurity 2a04:c300:400::185 (DE/Germany/-): 10 in the last 3600 secs; Ports: ...
show more
(modsecurity) srv102 ModSecurity 2a04:c300:400::185 (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇫🇷
dynamix
2026-06-22 22:52:09
(37 minutes ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 22:46:17
(43 minutes ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 18:46:10.328530 2026] [security2:error] [pid 27668:tid 27668] [client 2a04:c300:400::185:25138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.dcmillerjr.com"] [uri "/.env"] [unique_id "ajm7MtGIKu6tgAeqFZdJvQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 22:15:33
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 18:15:29.994621 2026] [security2:error] [pid 26900:tid 26900] [client 2a04:c300:400::185:32572] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.allisonannestudios.com"] [uri "/src/.env"] [unique_id "ajm0Afyf283gMML4wCHNjAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
XICTRON
2026-06-22 21:55:05
(1 hour ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 21:45:59
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 17:45:54.735910 2026] [security2:error] [pid 26871:tid 26871] [client 2a04:c300:400::185:28188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pinecp.rustyog.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pinecp.rustyog.net"] [uri "/wp-content/debug.log"] [unique_id "ajmtEh2P40BG-72Dy8MFaAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 21:27:01
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 17:26:54.837573 2026] [security2:error] [pid 29795:tid 29795] [client 2a04:c300:400::185:23066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.ryanc.net"] [uri "/.env"] [unique_id "ajmonmO0acfa8ba-YxC5rQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 21:04:31
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 17:04:23.305729 2026] [security2:error] [pid 11897:tid 11897] [client 2a04:c300:400::185:47248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.sylversheers.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.sylversheers.com"] [uri "/wp-content/debug.log"] [unique_id "ajmjV4Lz9a-Zo3II0r4PDAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-06-22 20:39:44
(2 hours ago)
{"level":"info","ts":1782159798.6784694,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1782159798.6784694,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"2a04:c300:400::185","remote_port":"14558","client_ip":"2a04:c300:400::185","proto":"HTTP/1.1","method":"GET","host":"swmi.status.updown.io","uri":"/","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0"]}},"bytes_read":0,"user_id":"","duration":0.000033914,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://swmi.status.updown.io/"],"Content-Type":[]}}
{"level":"info","ts":1782159804.312151,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"2a04:c300:400::185","remote_port":"12436","client_ip":"2a04:c300:400::185","proto":"HTTP/1.1","method":"GET","host":"swmi.status.updown.io","uri":"/service-account.json","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Fi
...
show less
DDoS Attack
Web App Attack
🇪🇸
alferez
2026-06-22 20:31:22
(2 hours ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 20:27:07
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 16:27:00.506043 2026] [security2:error] [pid 6851:tid 6851] [client 2a04:c300:400::185:33968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.discountbusinessholidaycards.com"] [uri "/backend/.env"] [unique_id "ajmalNapedIpf56kDYOlxwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 20:07:01
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 16:06:54.809876 2026] [security2:error] [pid 10734:tid 10734] [client 2a04:c300:400::185:37900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.stricklinphotography.com"] [uri "/.env.test"] [unique_id "ajmV3mpFOYAkKm6EOEyurwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-22 19:34:25
(3 hours ago)
460 requests with url.path *credentials.json
147 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-22 19:25:41
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::185 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 15:25:33.736370 2026] [security2:error] [pid 31405:tid 31405] [client 2a04:c300:400::185:1624] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.meshbagsandmore.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.meshbagsandmore.com"] [uri "/wp-content/debug.log"] [unique_id "ajmMLcvv_d5649VjFR1hzAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack