🇺🇸
TPI-Abuse
2026-09-21 05:56:43
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:56:40.389524 2026] [security2:error] [pid 21840:tid 21840] [client 35.247.152.31:42426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "finishlineenterprisesllc.com"] [uri "/src/.env"] [unique_id "arDHGL2B38nr8r7SX_Mr-wAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-09-21 05:35:11
(1 hour ago)
80,443
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-09-21 05:23:44
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:23:36.481395 2026] [security2:error] [pid 24445:tid 24538] [client 35.247.152.31:35534] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.rodela.com"] [uri "/.git/HEAD"] [unique_id "arC_WFAozzHTg-vN7scl2AAAANI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-21 04:05:57
(3 hours ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-09-21 03:03:05
(4 hours ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:45:49
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:45:44.220420 2026] [security2:error] [pid 445:tid 445] [client 35.247.152.31:38994] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rookscpa.com|F|2"] [data ".rookscpa.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rookscpa.com"] [uri "/z9x8c7v6b5-debug-trigger-www.rookscpa.com"] [unique_id "arCaWEHOvZwd9gf1HQKeSAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
melroy89
2026-09-21 02:42:26
(4 hours ago)
2026/09/21 04:42:26 [error] 3260724#3260724: *587813 limiting requests, excess: 5.368 by zone "ip", ...
show more
2026/09/21 04:42:26 [error] 3260724#3260724: *587813 limiting requests, excess: 5.368 by zone "ip", client: "35.247.152.31", server: "_", request_line: "GET /.env.js HTTP/1.1", host: "error.retromessenger.com"
2026/09/21 04:42:26 [error] 3260724#3260724: *587820 limiting requests, excess: 5.311 by zone "ip", client: "35.247.152.31", server: "_", request_line: "GET /public/env.js HTTP/1.1", host: "error.retromessenger.com"
2026/09/21 04:42:26 [error] 3260724#3260724: *587818 limiting requests, excess: 5.312 by zone "ip", client: "35.247.152.31", server: "_", request_line: "GET /service-worker.js HTTP/1.1", host: "error.retromessenger.com"
...
show less
Web App Attack
🇫🇮
paissangroup
2026-09-21 02:18:07
(4 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:08:17
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:08:10.015764 2026] [security2:error] [pid 26027:tid 26027] [client 35.247.152.31:47630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.taskmasterstech.com"] [uri "/config/.env"] [unique_id "arCRin5y4uaQsIeajs4vdwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 01:19:20
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:19:17.345096 2026] [security2:error] [pid 21840:tid 21840] [client 35.247.152.31:51170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.richardlyne.com"] [uri "/.env.bak"] [unique_id "arCGFbM166oXQ1ogrugNPwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 01:02:28
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:02:25.336955 2026] [security2:error] [pid 29099:tid 29099] [client 35.247.152.31:41306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ronjamestelevision.com"] [uri "/.env.production"] [unique_id "arCCIeJT4B1ONt6x3TzInAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:12:55
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:12:50.140001 2026] [security2:error] [pid 24822:tid 24822] [client 35.247.152.31:50768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "richsilver.com"] [uri "/.env.old"] [unique_id "arB2grjojQN_p11myYiP3AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:55:19
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.152.31 (31.152.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:55:12.684840 2026] [security2:error] [pid 23113:tid 23113] [client 35.247.152.31:53120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.robertseyewear.com"] [uri "/.git/config"] [unique_id "arByYLXVUpMtEzoMo_eGkwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-20 23:32:30
(7 hours ago)
20 attempts against mh_ha-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-09-20 22:50:15
(8 hours ago)
[Sun Sep 20 18:50:14.139365 2026] [authz_core:error] [pid 1807104:tid 139704481609472] [client 35.24 ...
show more
[Sun Sep 20 18:50:14.139365 2026] [authz_core:error] [pid 1807104:tid 139704481609472] [client 35.247.152.31:0] AH01630: client denied by server configuration: /var/www/vhosts/rodgersfertilizer.com/error_docs/forbidden.html, referer: https://rodgersfertilizer.com/z9x8c7v6b5-debug-trigger-rodgersfertilizer.com
[Sun Sep 20 18:50:14.591652 2026] [authz_core:error] [pid 1808416:tid 139704716474112] [client 35.247.152.31:0] AH01630: client denied by server configuration: /var/www/vhosts/rodgersfertilizer.com/httpdocs/.env, referer: https://rodgersfertilizer.com/@fs/../.env?raw??
[Sun Sep 20 18:50:14.591750 2026] [authz_core:error] [pid 1808416:tid 139704716474112] [client 35.247.152.31:0] AH01630: client denied by server configuration: /var/www/vhosts/rodgersfertilizer.com/error_docs/forbidden.html, referer: https://rodgersfertilizer.com/@fs/../.env?raw??
[Sun Sep 20 18:50:14.605259 2026] [authz_core:error] [pid 1821791:tid 139705479849728] [client 35.247.152.31:0] AH01630: client denied by
...
show less
Web App Attack