🇺🇸
TPI-Abuse
2026-09-21 06:40:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:40:52.253361 2026] [security2:error] [pid 3209:tid 3209] [client 35.229.160.186:60694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thehomemailbox.com"] [uri "/model/.env"] [unique_id "arDRdN6u4MozgGFgeUu8ZgAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 04:41:13
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:41:06.997667 2026] [security2:error] [pid 18660:tid 18660] [client 35.229.160.186:46482] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thechoicesy.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thechoicesy.com"] [uri "/z9x8c7v6b5-debug-trigger-thechoicesy.com"] [unique_id "arC1YuPLqH6mf5Qi2s8-kwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:29:37
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:29:30.774273 2026] [security2:error] [pid 27058:tid 27058] [client 35.229.160.186:48904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedieselgroupllc.com.resilientigm.com"] [uri "/infra/.env"] [unique_id "arCWikLOWo6cj5TpJm1pIQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:30:28
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:30:22.317007 2026] [security2:error] [pid 15224:tid 15273] [client 35.229.160.186:33988] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.theinfinitenow.com"] [uri "/project/.env"] [unique_id "arB6nksX1x8GyyDxJvuKjwAAAYw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:07:14
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:07:09.567682 2026] [security2:error] [pid 19955:tid 19955] [client 35.229.160.186:54066] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||herecometheplanes.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "herecometheplanes.com"] [uri "/z9x8c7v6b5-debug-trigger-herecometheplanes.com"] [unique_id "arB1Lb8vI94Nf2hBl8xDQwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:28:11
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:28:07.520344 2026] [security2:error] [pid 7136:tid 7136] [client 35.229.160.186:33842] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thekingtones.com"] [uri "/.git/config"] [unique_id "arBsB4lpJRgZizOs_y4PcQAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 22:58:16
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 18:58:12.607337 2026] [security2:error] [pid 5131:tid 5131] [client 35.229.160.186:41040] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thecharlesmadu.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thecharlesmadu.com"] [uri "/z9x8c7v6b5-debug-trigger-thecharlesmadu.com"] [unique_id "arBlBKX2xt3hKV46txenBgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-20 22:04:27
(2 days ago)
XSS Attempt
Hacking
🇺🇸
TPI-Abuse
2026-09-20 21:58:14
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:58:08.999345 2026] [security2:error] [pid 29892:tid 29892] [client 35.229.160.186:43442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.thekingofweed.com"] [uri "/.git/HEAD"] [unique_id "arBW8G2y2yBM5iBWue8KqQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 21:37:00
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:36:52.681715 2026] [security2:error] [pid 12270:tid 12270] [client 35.229.160.186:41516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.thedavidbowers.com"] [uri "/web/.env"] [unique_id "arBR9PXeTVNuWppPxMjoIQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 21:15:48
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:15:44.016973 2026] [security2:error] [pid 18271:tid 18271] [client 35.229.160.186:55626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.rudiscreations.com"] [uri "/.env.save"] [unique_id "arBNAGbFp0sIC_vyNESzTgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
svr
2026-09-20 21:14:07
(2 days ago)
Abusive Automated Web Scanner
Web App Attack
🇺🇸
H24
2026-09-20 21:09:19
(2 days ago)
/static../.env /@fs/../.env /index.php /document.php /backend/.env /api/uploads/../../.env /@fs/.env ...
show more
/static../.env /@fs/../.env /index.php /document.php /backend/.env /api/uploads/../../.env /@fs/.env /dashboard/.env /settings/.env /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ
show less
Web App Attack
🇮🇹
VHosting
2026-09-20 21:00:06
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 20:45:28
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.229.160.186 (186.160.229.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 16:45:23.008683 2026] [security2:error] [pid 14565:tid 14565] [client 35.229.160.186:56764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thehappywillow.com"] [uri "/.git/HEAD"] [unique_id "arBF4_aMsoJo_sa1qEpN3QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
