🇺🇸
TPI-Abuse
2026-10-02 14:40:34
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 10:40:29.252400 2026] [security2:error] [pid 11765:tid 11765] [client 35.237.234.20:56786] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sandboxspeech.org"] [uri "/wp-config.php.old"] [unique_id "ar_CXTZ9rC08Bu7yEP5R6AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 14:11:42
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 10:11:34.506194 2026] [security2:error] [pid 11350:tid 11350] [client 35.237.234.20:60430] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hongkonger.org"] [uri "/laravel/.env"] [unique_id "ar-7lr_z14knFA8qpPyqEwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-10-02 13:50:35
(3 weeks ago)
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ...
show more
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths.
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 13:46:28
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:46:21.602333 2026] [security2:error] [pid 920828:tid 920828] [client 35.237.234.20:34634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.yanchuk.org"] [uri "/uploads../.env"] [unique_id "ar-1rXMn87_jyiY-e7X5xAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 13:10:47
(3 weeks ago)
(mod_security) mod_security (id:949110) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:949110) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:10:39.856191 2026] [security2:error] [pid 19567:tid 19567] [client 35.237.234.20:44778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "forum.freedrm.org"] [uri "/server.key"] [unique_id "ar-tT74uxbNCbWK4fJHASAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-02 12:36:35
(3 weeks ago)
[Fri Oct 02 06:36:33.058574 2026] [authz_core:error] [pid 94168:tid 140268605060672] [client 35.237. ...
show more
[Fri Oct 02 06:36:33.058574 2026] [authz_core:error] [pid 94168:tid 140268605060672] [client 35.237.234.20:59818] AH01630: client denied by server configuration: /var/www/horde/config/firebase-admin.json
[Fri Oct 02 06:36:33.097811 2026] [authz_core:error] [pid 94168:tid 140268605060672] [client 35.237.234.20:59818] AH01630: client denied by server configuration: /var/www/horde/config/gcp-credentials.json
[Fri Oct 02 06:36:34.541652 2026] [authz_core:error] [pid 94168:tid 140268546311744] [client 35.237.234.20:59818] AH01630: client denied by server configuration: /var/www/horde/config/.env
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 12:22:44
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 08:22:40.160566 2026] [security2:error] [pid 7938:tid 7938] [client 35.237.234.20:41256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.mylert.org"] [uri "/%2e%2e/.env"] [unique_id "ar-iEFGSSG1u-bF9qbR93AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-10-02 12:11:00
(3 weeks ago)
2026-10-02 14:09:41 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ) && 20 ...
show more
2026-10-02 14:09:41 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ) && 2026-10-02 14:09:42 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env) && 2026-10-02 14:09:42 AH10244: invalid URI path (/appearance/../../proc/self/environ) && 99 more within 20 minutes
show less
Web App Attack
🇩🇪
macrob
2026-10-02 11:47:09
(3 weeks ago)
2026/10/02 11:47:07 [error] 2231818#2231818: *8421175 access forbidden by rule, client: 35.237.234.2 ...
show more
2026/10/02 11:47:07 [error] 2231818#2231818: *8421175 access forbidden by rule, client: 35.237.234.20, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "inference.wellbin.org"
2026/10/02 11:47:07 [error] 2231818#2231818: *8421181 access forbidden by rule, client: 35.237.234.20, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "inference.wellbin.org"
2026/10/02 11:47:07 [error] 2231818#2231818: *8421191 access forbidden by rule, client: 35.237.234.20, server: fn.binixo.es, request: "GET /admin HTTP/2.0", host: "inference.wellbin.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 11:15:28
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:15:25.698160 2026] [security2:error] [pid 26588:tid 26588] [client 35.237.234.20:50738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thesilverlegion.org"] [uri "/.env.js"] [unique_id "ar-STZNggMAvVWWpFWZEXAAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-02 11:10:53
(3 weeks ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 10:52:34
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:52:30.240832 2026] [security2:error] [pid 25199:tid 25199] [client 35.237.234.20:57646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.professionalpartyplanner.org"] [uri "/.env.js"] [unique_id "ar-M7tsxJzaQxfkD6Sw0HQAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 10:36:49
(3 weeks ago)
(mod_security) mod_security (id:210580) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210580) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:36:41.833150 2026] [security2:error] [pid 8016:tid 8092] [client 35.237.234.20:55368] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||mail.newtrendmag.org|F|2"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "mail.newtrendmag.org"] [uri "/api/fs/read"] [unique_id "ar-JOV8n3FNl048UrCIYywAAAMc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 09:09:58
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:09:53.660822 2026] [security2:error] [pid 23993:tid 23993] [client 35.237.234.20:38886] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.universitydental.org|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.universitydental.org"] [uri "/server.key"] [unique_id "ar904Qox7wwWc1p02D_LngAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 08:51:09
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.237.234.20 (20.234.237.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 04:51:03.116600 2026] [security2:error] [pid 27394:tid 27394] [client 35.237.234.20:58496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.nebraskaadaptivesports.org"] [uri "/web.config"] [unique_id "ar9wdymnvpA_5TvHXG1GqAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack