๐น๐ท
ScchutzZ
2026-10-01 18:05:04
(1 week ago)
Fail2Ban banฤฑ. Jail: plesk-modsecurity.
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-10-01 16:07:50
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 12:07:43.524684 2026] [security2:error] [pid 29878:tid 29878] [client 35.247.228.173:43854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.billhoy.com"] [uri "/assets../.env"] [unique_id "ar6FTxm_KW5tCk68o_iXFQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-01 16:05:05
(1 week ago)
Blocked by ModSec and CSF
Port Scan
๐ฒ๐พ
Rizzy
2026-10-01 15:39:38
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 15:17:56
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:17:52.566539 2026] [security2:error] [pid 15906:tid 15906] [client 35.247.228.173:48494] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.development-dynamics.com"] [uri "/wp-config.php.bak"] [unique_id "ar55oKrm1AtPwZ5-ePPLTgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 14:57:00
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 10:56:54.876830 2026] [security2:error] [pid 26146:tid 26146] [client 35.247.228.173:49994] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dgroupsa.com|F|2"] [data ".dgroupsa.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dgroupsa.com"] [uri "/z9x8c7v6b5-debug-trigger-www.dgroupsa.com"] [unique_id "ar50tnCzMya9oD3k2xKf2AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Savvii
2026-10-01 14:19:07
(1 week ago)
20 attempts against mh-misbehave-ban on ec102950
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 13:50:16
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:50:11.678513 2026] [security2:error] [pid 28990:tid 28990] [client 35.247.228.173:51848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.babylontravelone.com"] [uri "/.env.dev"] [unique_id "ar5lE8KOZNIb2--r4MwH1QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 13:16:40
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 09:16:35.091613 2026] [security2:error] [pid 6782:tid 6782] [client 35.247.228.173:41168] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||edgecomix.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "edgecomix.com"] [uri "/z9x8c7v6b5-debug-trigger-edgecomix.com"] [unique_id "ar5dM8L9SdimzYsCoCzkwQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 12:57:41
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:57:36.702096 2026] [security2:error] [pid 23001:tid 23001] [client 35.247.228.173:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.backlogica.com"] [uri "/.env.dev"] [unique_id "ar5YwEPy1c5bFLaRLPl3RAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฟ๐ฆ
conure.sh
2026-10-01 12:55:28
(1 week ago)
csagent: score 15.2: 404 noise floor x21, secrets grab x1; 1 domain(s) in 2s
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 12:38:09
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:38:04.685396 2026] [security2:error] [pid 15662:tid 15662] [client 35.247.228.173:49248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cgautomatizacion.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cgautomatizacion.com"] [uri "/z9x8c7v6b5-debug-trigger-cgautomatizacion.com"] [unique_id "ar5ULBJy_S328ukjEm8q2AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Site.eu
2026-10-01 12:29:11
(1 week ago)
Excessive multi-domain requests
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-10-01 12:07:54
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:07:49.547956 2026] [security2:error] [pid 5531:tid 5531] [client 35.247.228.173:45648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.dandemonium.net"] [uri "/.env.js"] [unique_id "ar5NFcNPbt5tbVQc9QSezgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-01 11:47:52
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.228.173 (173.228.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 07:47:45.305617 2026] [security2:error] [pid 21065:tid 21065] [client 35.247.228.173:42848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.easylandcash.com"] [uri "/.env.development"] [unique_id "ar5IYe7e-xd1cBBsTCLa0QAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
