🇺🇸
TPI-Abuse
2026-06-23 12:24:55
(47 minutes ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 08:24:51.859825 2026] [security2:error] [pid 27747:tid 27747] [client 2a04:c300:400::199:45550] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||stindustries.us|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stindustries.us"] [uri "/wp-content/debug.log"] [unique_id "ajp7E84IFQPxkvoy8-vbJAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 11:54:52
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 07:54:47.633988 2026] [security2:error] [pid 8940:tid 8940] [client 2a04:c300:400::199:37928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.jacksonpropertyrentals.com"] [uri "/.env.bak"] [unique_id "ajp0B-1rixAX4kwDsADyjAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 11:33:07
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 07:33:01.135027 2026] [security2:error] [pid 8872:tid 8872] [client 2a04:c300:400::199:45610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.gulftelecom.com"] [uri "/.env"] [unique_id "ajpu7cGQe1Pkf5nD6QBG5QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 11:18:00
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 07:17:54.507876 2026] [security2:error] [pid 6904:tid 6904] [client 2a04:c300:400::199:29642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.stapleton.productions"] [uri "/.env"] [unique_id "ajprYiuTNmYHejFSsiPZnwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 10:25:22
(2 hours ago)
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 06:25:15.679327 2026] [security2:error] [pid 9145:tid 9145] [client 2a04:c300:400::199:50220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vdeweese.com"] [uri "/wp-content/debug.log"] [unique_id "ajpfC6j6Shx20bbTYEPpkwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-06-23 08:57:51
(4 hours ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 05:59:01
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:58:55.616330 2026] [security2:error] [pid 9898:tid 9898] [client 2a04:c300:400::199:17684] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.roachranch.com"] [uri "/.env"] [unique_id "ajogn9eAJOmIRQBSXW0PhQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-06-23 05:46:44
(7 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-06-23 05:36:41
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:36:34.738120 2026] [security2:error] [pid 16771:tid 16874] [client 2a04:c300:400::199:63558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kandooo.com"] [uri "/web/.env"] [unique_id "ajobYl_WkJoaShq8gzUYNQAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 05:08:36
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:08:28.430067 2026] [security2:error] [pid 10863:tid 10863] [client 2a04:c300:400::199:43358] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.jasonpolland.com"] [uri "/app/.env"] [unique_id "ajoUzDYJ8-t2PiFrvOIpcwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-23 05:02:03
(8 hours ago)
[TueJun2307:02:00.7464772026][security2:error][pid2855496:tid2855517][client2a04:c300:400::199:0]Mod ...
show more
[TueJun2307:02:00.7464772026][security2:error][pid2855496:tid2855517][client2a04:c300:400::199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"mail.cmsolution.ch\"][uri\"/wp-content/debug.log\"][unique_id\"ajoTSCzo8m2IPuCEOTxnMgAAAJI\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 04:17:30
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 00:17:24.760488 2026] [security2:error] [pid 31251:tid 31251] [client 2a04:c300:400::199:64504] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.billhoy.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.billhoy.com"] [uri "/wp-content/debug.log"] [unique_id "ajoI1KhCDb7cvzvOJIKh3QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-06-23 01:32:24
(11 hours ago)
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::199 (Unknown): N in the last X s ...
show more
(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::199 (Unknown): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 00:48:31
(12 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 20:48:26.665031 2026] [security2:error] [pid 8107:tid 8107] [client 2a04:c300:400::199:46248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.thinkerblox.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.thinkerblox.com"] [uri "/wp-content/debug.log"] [unique_id "ajnX2gBCK1vOx5oHGETfygAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 23:11:35
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 19:11:27.420915 2026] [security2:error] [pid 10898:tid 10928] [client 2a04:c300:400::199:48472] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.ceol.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.ceol.com"] [uri "/wp-content/debug.log"] [unique_id "ajnBH3RlnWsuJ799rlh_HQAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack