🇺🇸
TPI-Abuse
2026-06-22 00:43:01
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 20:42:57.076805 2026] [security2:error] [pid 9524:tid 9524] [client 2a04:c300:400::1cb:43848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.elfinforest.net"] [uri "/.env"] [unique_id "ajiFEYeKR07BWED9-5VYjQAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-22 00:23:58
(3 hours ago)
2a04:c300:400::1cb - - [22/Jun/2026:00:23:57 +0000] "GET /.docker/config.json HTTP/2.0" 404 1005 "h ...
show more
2a04:c300:400::1cb - - [22/Jun/2026:00:23:57 +0000] "GET /.docker/config.json HTTP/2.0" 404 1005 "https://ivonnesanchez.com/.docker/config.json" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "2a04:c300:400::1cb" "-"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 00:03:21
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 20:03:18.340365 2026] [security2:error] [pid 26550:tid 26550] [client 2a04:c300:400::1cb:55928] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||silkenswift.borzois.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "silkenswift.borzois.com"] [uri "/wp-content/debug.log"] [unique_id "ajh7xu9JSxwCrV7Ye70ruAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-06-21 23:49:51
(3 hours ago)
(modsecurity) srv102 ModSecurity 2a04:c300:400::1cb (DE/Germany/-): 10 in the last 3600 secs; Ports: ...
show more
(modsecurity) srv102 ModSecurity 2a04:c300:400::1cb (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇩🇪
pscriptos
2026-06-21 23:22:51
(4 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-06-21 22:14:48
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 18:14:43.041069 2026] [security2:error] [pid 18803:tid 18803] [client 2a04:c300:400::1cb:12164] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||notforhirellc.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "notforhirellc.com"] [uri "/wp-content/debug.log"] [unique_id "ajhiU8fA3vuMLPVyd_lyjgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Charlesiv
2026-06-21 22:00:15
(5 hours ago)
Triggered Cloudflare WAF (linkMaze) from US.
Action taken: LINK_MAZE_INJECTED
ASN: 22295 (Advin Serv ...
show more
Triggered Cloudflare WAF (linkMaze) from US.
Action taken: LINK_MAZE_INJECTED
ASN: 22295 (Advin Services LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2026-06-21T21:29:35Z
Ray ID: a0f61c0b6df78766
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-21 21:53:53
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 17:53:47.328902 2026] [security2:error] [pid 12023:tid 12023] [client 2a04:c300:400::1cb:18528] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.clossglobal.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.clossglobal.com"] [uri "/wp-content/debug.log"] [unique_id "ajhdayJiuPc8zeMptVMSoAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2026-06-21 21:15:02
(6 hours ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
2026-06-21 21:14:03
(6 hours ago)
Aggressive web scan
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 20:52:23
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 16:52:20.167734 2026] [security2:error] [pid 27329:tid 27329] [client 2a04:c300:400::1cb:7068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.asterioland.com"] [uri "/.env"] [unique_id "ajhPBET8sSoTrqx_EJcT-QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 20:13:30
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 16:13:23.982193 2026] [security2:error] [pid 11943:tid 11943] [client 2a04:c300:400::1cb:9394] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.cthog.xyz"] [uri "/.env"] [unique_id "ajhF42y5TY990oSnZySydgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 19:49:39
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1cb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 15:49:36.637224 2026] [security2:error] [pid 28667:tid 28667] [client 2a04:c300:400::1cb:7356] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kellermoving.com"] [uri "/.env"] [unique_id "ajhAUH1_usIO-PjZU8cYuAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BiancaNL
2026-06-21 19:19:49
(8 hours ago)
Fail2Ban: jail=nginx-exploit-probes on <fqdn> (port=<port>)
Hacking
🇩🇪
igerman
2026-06-21 19:14:38
(8 hours ago)
caddy probes: env-probe: GET /.env.bak(DROP), GET /.env.production(DROP), GET /.env.save(DROP), GET ...
show more
caddy probes: env-probe: GET /.env.bak(DROP), GET /.env.production(DROP), GET /.env.save(DROP), GET /.env.test(DROP), GET /app/.env(DROP), GET /laravel/.env(DROP) | web: GET /(DROP), GET /.openclaw/openclaw.json(DROP), GET /appsettings.Development.json(DROP), GET /client_secrets.json(DROP), GET /credentials.json(DROP), GET /credentials/service-account.json(DROP), GET /firebase-adminsdk.json(DROP), GET /firebase_credentials.json(DROP), GET /gcloud-service-key.json(DROP), GET /google-credentials.json(DROP), GET /google_key.json(DROP), GET /google_service_app.json(DROP), GET /keyfile.json(DROP), GET /secrets.json(DROP), GET /service-account-config.json(DROP), GET /service-account-key.json(DROP), GET /service-account.json(DROP), GET /service_account.json(DROP) | wordpress: GET /wp-content/debug.log(DROP)
show less
Web App Attack