🇳🇱
homeshowdomain.nl
2026-05-28 22:03:36
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-27.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-28 02:42:25
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 22:42:16.737339 2026] [security2:error] [pid 23147:tid 23147] [client 38.154.200.39:46139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.cromaki.com"] [uri "/.env"] [unique_id "aheriIdyzwvefMQXxJbGBgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-28 01:53:49
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 21:53:40.961471 2026] [security2:error] [pid 12849:tid 12849] [client 38.154.200.39:53679] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greed.wisk.org"] [uri "/.env.bak"] [unique_id "ahegJEukWXZYcmcA1vW_kQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 17:45:45
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 13:45:40.532567 2026] [security2:error] [pid 8132:tid 8132] [client 38.154.200.39:57955] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.title-26.vittariadesign.com"] [uri "/wp-config.php.save"] [unique_id "ahctxIthJEgSSLZOqRmxewAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 12:18:42
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 08:18:36.013223 2026] [security2:error] [pid 29455:tid 29455] [client 38.154.200.39:59533] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bernabeu.org"] [uri "/wp-config.old"] [unique_id "ahbhHAKdw4z5nV-kfbufrAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:57:25
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:56:59.280021 2026] [security2:error] [pid 14400:tid 14400] [client 38.154.200.39:48125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pocosfarm.littlehorndesign.com"] [uri "/app/config/parameters.yml"] [unique_id "ahZBWyANowaCcdsVV-wtLQAAABU"], referer: https://www.google.com/search?q=www.pocosfarm.littlehorndesign.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:22:07
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.154.200.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:21:56.962623 2026] [security2:error] [pid 26488:tid 26618] [client 38.154.200.39:48483] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brucejoell.com"] [uri "/wp-config.php"] [unique_id "ahY5JCaZlgStTS-rKETVlAAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-26 21:59:14
(3 weeks ago)
Auto-ban: >3000 req/min op 2026-05-26
Web App Attack
SSH
Hacking