🇺🇸
TPI-Abuse
2026-05-28 01:51:24
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 21:51:19.302236 2026] [security2:error] [pid 21168:tid 21168] [client 38.154.197.212:42295] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mahoninginn.com"] [uri "/wp-config.php.swp"] [unique_id "ahefl-mY4c5pW8famL5aiAAAAA0"], referer: https://www.google.com/search?q=mahoninginn.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-27 22:01:03
(4 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-26.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-27 12:10:23
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 08:10:16.842745 2026] [security2:error] [pid 9783:tid 9783] [client 38.154.197.212:52393] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.documents.progressivefileshare.org"] [uri "/.env.backup"] [unique_id "ahbfKKZ_I1oDX5WM2z7O-wAAAAw"], referer: https://www.google.com/search?q=www.documents.progressivefileshare.org
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-05-27 00:57:00
(4 weeks ago)
[WedMay2702:56:52.9367852026][security2:error][pid366231:tid366458][client38.154.197.212:0]ModSecuri ...
show more
[WedMay2702:56:52.9367852026][security2:error][pid366231:tid366458][client38.154.197.212:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"carolin-mizio.ch.81-17-25-250.cpanel.site\"][uri\"/wp-config.php.swp\"][unique_id\"ahZBVHnH08FBH6UBi3zTsQAAANA\"]\,referer:https://www.google.com/search\?q=carolin-mizio.ch.81-17-25-250.cpanel.site
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:21:20
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:21:09.770959 2026] [security2:error] [pid 23245:tid 23245] [client 38.154.197.212:35407] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theprideproject.net"] [uri "/.env.save"] [unique_id "ahY49cCumU3jK45tZS5p0gAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 18:08:23
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 14:08:18.424010 2026] [security2:error] [pid 19386:tid 19386] [client 38.154.197.212:46979] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.josephnine.com.evannine.com"] [uri "/.env.backup"] [unique_id "ahXhkuUQinnSQjLu3HKwaQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-03 13:47:20
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 03 09:44:36.579181 2025] [security2:error] [pid 13360:tid 13381] [client 38.154.197.212:38637] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.staging.kettlehill.com"] [uri "/.svn/wc.db"] [unique_id "aGaJRKUco3AoK6nd7NE5ngAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 23:58:06
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.197.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 19:58:00.052614 2025] [security2:error] [pid 3792918:tid 3792918] [client 38.154.197.212:55725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.farmers123.com"] [uri "/.env.dev.local"] [unique_id "aDj0iIa8RsXy36CXKTNNSgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-26 09:25:43
(1 year ago)
38.154.197.212 - - [26/Jan/2025:10:25:42 +0100] "GET /..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F. ...
show more
38.154.197.212 - - [26/Jan/2025:10:25:42 +0100] "GET /..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini HTTP/1.1" 404 453 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
...
show less
Hacking
2025-01-17 15:51:11
(1 year ago)
| A web attack returned code 200 (success).
Hacking
SQL Injection
Web App Attack