🇷🇸
pexodelic
2026-10-02 04:05:02
(6 days ago)
Automated report from web, SSH and FTP server logs: 304 requests probing for exposed secrets (.env, ...
show more
Automated report from web, SSH and FTP server logs: 304 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-01 15:05 UTC, last reported 2026-10-02 06:05 UTC; counts cover the current log rotation window.
show less
Hacking
Web App Attack
2026-10-01 15:53:45
(6 days ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 15:10:18
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:10:14.168394 2026] [security2:error] [pid 25827:tid 25827] [client 34.179.245.222:57362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.vffv.com"] [uri "/.htpasswd"] [unique_id "ar531n0xrdIME9ml8RRVJQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-01 15:01:00
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 14:54:11
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:54:03.730356 2026] [security2:error] [pid 28037:tid 28037] [client 34.179.245.222:48948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.smogsandiego.com"] [uri "/assets../.env"] [unique_id "ar50C27lEcnmgJ_76nlRPgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 14:19:36
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:19:30.134408 2026] [security2:error] [pid 29176:tid 29176] [client 34.179.245.222:46242] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.theseoscribe.com|F|2"] [data ".theseoscribe.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.theseoscribe.com"] [uri "/z9x8c7v6b5-debug-trigger-www.theseoscribe.com"] [unique_id "ar5r8vOxMeZXH0qe9WMceAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-10-01 14:17:23
(1 week ago)
Bad bot identified by user agent
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-01 14:00:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:00:33.398855 2026] [security2:error] [pid 19297:tid 19392] [client 34.179.245.222:46924] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.tomi-thai.com"] [uri "/@fs/.env"] [unique_id "ar5ngcPncDF-ObkqGPNQ-gAAAZM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 13:40:56
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:40:49.859200 2026] [security2:error] [pid 28421:tid 28421] [client 34.179.245.222:47178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sendvalentinecard.com"] [uri "/files../.env"] [unique_id "ar5i4ZOLIhXHsYJduc4EzAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 13:20:18
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:20:14.141518 2026] [security2:error] [pid 11371:tid 11371] [client 34.179.245.222:53914] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||apps.97201.com|F|2"] [data ".97201.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "apps.97201.com"] [uri "/z9x8c7v6b5-debug-trigger-apps.97201.com"] [unique_id "ar5eDjYRNyGtpwyP0jWK7AAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-01 13:06:04
(1 week ago)
Multiple WAF Violations
Web App Attack
🇮🇹
VHosting
2026-10-01 13:05:03
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 12:57:23
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.179.245.222 (222.245.179.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:57:15.952114 2026] [security2:error] [pid 4601:tid 4601] [client 34.179.245.222:50554] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.waggonerfinancial.com|F|2"] [data ".waggonerfinancial.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.waggonerfinancial.com"] [uri "/z9x8c7v6b5-debug-trigger-www.waggonerfinancial.com"] [unique_id "ar5YqxBvOFOaqMSQYTMa7wAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
