🇮🇳
evicky2002
2026-08-02 06:00:00
(13 minutes ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-02 05:10:09
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 01:10:01.703117 2026] [security2:error] [pid 3309971:tid 3309971] [client 45.55.140.220:44862] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bobbyunser.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bobbyunser.com"] [uri "/s3cmd.ini"] [unique_id "am7RKaLQaLAIIka1xKeOLAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 04:45:49
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 00:45:45.080039 2026] [security2:error] [pid 3382511:tid 3382511] [client 45.55.140.220:46058] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mrbaystreet.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mrbaystreet.com"] [uri "/s3cmd.ini"] [unique_id "am7LecV-OWjQmz_U_H9NeAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
FreeMyIP
2026-08-02 04:36:16
(1 hour ago)
Automated fail2ban report: web application attack / scanning for exploitable paths.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 04:20:11
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 00:20:05.196777 2026] [security2:error] [pid 2882975:tid 2882975] [client 45.55.140.220:38012] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prezence.com"] [uri "/.env"] [unique_id "am7FdQwtFk7a7sVQNbNhOgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 03:20:22
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 23:20:18.849405 2026] [security2:error] [pid 1692836:tid 1692836] [client 45.55.140.220:59880] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cyclingboardgames.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cyclingboardgames.net"] [uri "/s3cmd.ini"] [unique_id "am63cqbUCdhaIgT3EoUepgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-08-02 03:10:35
(3 hours ago)
20 attempts against mh-misbehave-ban on solar
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
entangled_mongoose
2026-08-02 02:46:55
(3 hours ago)
Probed /wp-config.php.bak.
Web App Attack
🇩🇪
grassau.com
2026-08-02 02:32:26
(3 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 45.55.140.220 (US/United States/New Jer ...
show more
(mod_security) mod_security triggered on hostname [redacted] 45.55.140.220 (US/United States/New Jersey/Clifton/-)
show less
SQL Injection
🇳🇱
Savvii
2026-08-02 02:22:22
(3 hours ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-02 02:04:47
(4 hours ago)
CrowdSec: crowdsecurity/http-sensitive-files | req: /api/.env | 5 distinct paths | UA: Go-http-clien ...
show more
CrowdSec: crowdsecurity/http-sensitive-files | req: /api/.env | 5 distinct paths | UA: Go-http-client/2.0
show less
Hacking
🇺🇸
TPI-Abuse
2026-08-02 01:55:47
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 21:55:42.790967 2026] [security2:error] [pid 1366544:tid 1366547] [client 45.55.140.220:47966] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.a2zlns.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.a2zlns.com"] [uri "/s3cmd.ini"] [unique_id "am6jnoS9zaVfBhC8sp4qjwAAAYE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 01:32:02
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 21:31:56.483008 2026] [security2:error] [pid 3417434:tid 3417480] [client 45.55.140.220:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||earthtravel.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "earthtravel.net"] [uri "/s3cmd.ini"] [unique_id "am6eDJdPi5DZirReeoR1QAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-02 01:13:10
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.55.140.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 21:13:04.371389 2026] [security2:error] [pid 3441843:tid 3441843] [client 45.55.140.220:53706] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.register-yacht-germany.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.register-yacht-germany.com"] [uri "/s3cmd.ini"] [unique_id "am6ZoAN22I669qHPqAoIUwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
XICTRON
2026-08-02 00:10:06
(6 hours ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack