🇬🇧
consul.to
2026-05-29 09:12:07
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-28 22:03:25
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-27.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-28 01:53:54
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 21:53:44.044917 2026] [security2:error] [pid 21598:tid 21598] [client 31.59.20.38:48911] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dezdezero.com"] [uri "/.env.local"] [unique_id "ahegKGHAjcGauB8iDfaLRAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 20:45:27
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 16:45:16.799373 2026] [security2:error] [pid 10638:tid 10638] [client 31.59.20.38:34481] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.postseason.michaelpmcgrath.com"] [uri "/.env.local"] [unique_id "ahdX3CGb_K8oFklFsL38NgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
OceanTreasure
2026-05-27 19:45:28
(3 weeks ago)
tcp/443; SQL backup file access attempt: "HEAD /backup.sql.gz" @ 2026-05-27T19:36:34Z [proxy]
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:23:23
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:23:18.538611 2026] [security2:error] [pid 26044:tid 26044] [client 31.59.20.38:56551] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sanjuangrange.org|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sanjuangrange.org"] [uri "/config/master.key"] [unique_id "ahY5dkRM1KHoK5ZMebPVHAAAAAE"], referer: https://www.google.com/search?q=sanjuangrange.org
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 18:21:06
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 14:20:55.222467 2026] [security2:error] [pid 4572:tid 4572] [client 31.59.20.38:57599] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "seizetheseason.com"] [uri "/wp-config.php.save"] [unique_id "ahXkh7Q47abYAqeC7P2TmgAAAA0"], referer: https://www.google.com/search?q=seizetheseason.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 17:57:38
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 31.59.20.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 13:57:08.974767 2026] [security2:error] [pid 25551:tid 25551] [client 31.59.20.38:48383] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.l3prime.systemcapacityoptimization.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.l3prime.systemcapacityoptimization.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "ahXe9PSBoj4GScsttcXR1AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack