🇺🇸
TPI-Abuse
2026-06-27 04:35:33
(15 minutes ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 00:35:29.481056 2026] [security2:error] [pid 9664:tid 9670] [client 2a09:bac5:9440:4e6::7d:92:52768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.peimbert.com"] [uri "/.env"] [unique_id "aj9TEQIxKsw-YXKEEK_oIwAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-27 02:29:49
(2 hours ago)
119 requests with url.path *.env
118 requests with url.path *.aws/*
Brute-Force
Bad Web Bot
🇩🇪
updown.io
2026-06-26 22:36:45
(6 hours ago)
{"level":"info","ts":1782513397.590919,"logger":"http.log.access.log0","msg":"handled request","requ ...
show more
{"level":"info","ts":1782513397.590919,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"2a09:bac5:9440:4e6::7d:92","remote_port":"45558","client_ip":"2a09:bac5:9440:4e6::7d:92","proto":"HTTP/1.1","method":"GET","host":"f7gq.status.updown.io","uri":"/.aws/config","headers":{"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"f7gq.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.001213307,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1782513397.6124258,"logger":"http.log.access.log0","msg":"handled request","request":{"remo
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 22:36:37
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 18:36:30.899978 2026] [security2:error] [pid 308:tid 308] [client 2a09:bac5:9440:4e6::7d:92:20686] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.johnlittlehorn.com"] [uri "/internal/.htpasswd"] [unique_id "aj7-7sCK0Z5qClyhnVVB_gAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-06-26 21:19:00
(7 hours ago)
IPBlock protected site ID [3192-af][s=02].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 16:18:19
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 12:18:13.218989 2026] [security2:error] [pid 32119:tid 32119] [client 2a09:bac5:9440:4e6::7d:92:57930] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.agribrokers.net"] [uri "/.env"] [unique_id "aj6mRUJxnyB0c_O_mKw1rgAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 15:49:22
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 11:49:16.169736 2026] [security2:error] [pid 3941:tid 3960] [client 2a09:bac5:9440:4e6::7d:92:9326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.howilearnedtodanceintherain.com"] [uri "/.env"] [unique_id "aj6ffJKKAllyF5WL_pNjoQAAANA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 10:56:14
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 06:56:07.263114 2026] [security2:error] [pid 29414:tid 29414] [client 2a09:bac5:9440:4e6::7d:92:11122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.okeetokee.org"] [uri "/dist/wp-config.php"] [unique_id "aj5ax2qiQILWeXWZkk8nXwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 09:00:39
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 05:00:30.186918 2026] [security2:error] [pid 8623:tid 8623] [client 2a09:bac5:9440:4e6::7d:92:39440] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.inmaine.us"] [uri "/internal/.htpasswd"] [unique_id "aj4_rss7108rODIqKrUHrwAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 08:13:51
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 04:13:46.559166 2026] [security2:error] [pid 20195:tid 20195] [client 2a09:bac5:9440:4e6::7d:92:30892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.aivosminerals.com"] [uri "/laravel/.env"] [unique_id "aj40uox_oj2eUuB-tkmwHAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 07:57:08
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 03:57:02.709411 2026] [security2:error] [pid 2520:tid 2520] [client 2a09:bac5:9440:4e6::7d:92:40452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.julianunplugged.com"] [uri "/laravel/.htpasswd"] [unique_id "aj4wzjVLHuR5K-DH2u6NVgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 07:17:18
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:9440:4e6::7d:92 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 03:17:13.312136 2026] [security2:error] [pid 7856:tid 7856] [client 2a09:bac5:9440:4e6::7d:92:61248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.csiwebdesigns.com"] [uri "/dist/.htpasswd"] [unique_id "aj4nebN534chr0rcvZdqQAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-06-26 06:50:10
(22 hours ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack