🇦🇺
iBlockBadBots
2026-09-22 10:00:13
(3 weeks ago)
WAF blocked multiple times in 24h. Paths: /.env.example; /llm/.env; /.env.bak; /.htpasswd; /index.ph ...
show more
WAF blocked multiple times in 24h. Paths: /.env.example; /llm/.env; /.env.bak; /.htpasswd; /index.php
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:56:00
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:55:53.988265 2026] [security2:error] [pid 15295:tid 15295] [client 35.231.49.221:33304] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gulftelecom.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gulftelecom.com"] [uri "/z9x8c7v6b5-debug-trigger-gulftelecom.com"] [unique_id "arHgKXOvfE3Fnl_iGBHPfQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 01:02:33
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:02:29.429751 2026] [security2:error] [pid 21495:tid 21495] [client 35.231.49.221:32964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.brokenglasstelecom.com"] [uri "/web/.env"] [unique_id "arHTpX9t3FefsK3Z8M-aowAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-09-22 00:35:10
(3 weeks ago)
Aggressive web search of vulnerable pages: /api/console/api_server?sense_version=%40%40SENSE_VERSION ...
show more
Aggressive web search of vulnerable pages: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env /docker-compos ...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 00:30:23
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:30:18.206501 2026] [security2:error] [pid 11010:tid 11010] [client 35.231.49.221:58550] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bradmackenzie.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bradmackenzie.com"] [uri "/z9x8c7v6b5-debug-trigger-bradmackenzie.com"] [unique_id "arHMGuX1MSJIBZ6SEZ5bAAAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:16:28
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:16:19.250996 2026] [security2:error] [pid 24677:tid 24677] [client 35.231.49.221:54152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.buanamegah.com"] [uri "/.env.backup"] [unique_id "arG6w_-pShHR1SZkbSkB3wAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-21 21:05:22
(3 weeks ago)
Scanning/Probing (15)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 20:44:16
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 16:44:10.054134 2026] [security2:error] [pid 5177:tid 5177] [client 35.231.49.221:37148] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||braleygroup.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "braleygroup.com"] [uri "/z9x8c7v6b5-debug-trigger-braleygroup.com"] [unique_id "arGXGr7Xccj5dzE-s2DX8AAAAFE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
abivia
2026-09-21 19:31:25
(3 weeks ago)
Abivia WAF trigger: Rule scriptKiddies: Credential probing uri: /config.js
Hacking
🇺🇸
TPI-Abuse
2026-09-21 19:28:57
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 15:28:53.282324 2026] [security2:error] [pid 9977:tid 9977] [client 35.231.49.221:37488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.spyasociados.com"] [uri "/.git/HEAD"] [unique_id "arGFdShc9LzROQSfl475AQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 19:01:13
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 15:01:07.390109 2026] [security2:error] [pid 14800:tid 14800] [client 35.231.49.221:35048] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bosdkbook.com"] [uri "/.env.prod"] [unique_id "arF-8xV7kEbnne4O6768WgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 18:12:43
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 14:12:35.960360 2026] [security2:error] [pid 2656:tid 2656] [client 35.231.49.221:55082] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.horsesaw.com|F|2"] [data ".horsesaw.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.horsesaw.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.horsesaw.com"] [unique_id "arFzk-m8DbGSnIlHYTE6HQAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-21 18:00:38
(3 weeks ago)
git/env leak probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 17:20:38
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.49.221 (221.49.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:20:30.090222 2026] [security2:error] [pid 31692:tid 31692] [client 35.231.49.221:60830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.brinkworthdungeon.com"] [uri "/app/.env"] [unique_id "arFnXm8y1cpq8pkomuMF8AAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-09-21 17:04:55
(3 weeks ago)
Repeated exploit attempts, for example: /.git/config /.git/config (HTTP/1.1 port 443, user agent: "M ...
show more
Repeated exploit attempts, for example: /.git/config /.git/config (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)")
show less
Web App Attack
