🇺🇸
mnsf
2026-05-29 12:05:12
(1 week ago)
Abuse Detected (1)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 11:42:04
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 07:41:23.893701 2026] [security2:error] [pid 13136:tid 13136] [client 64.64.115.36:38881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rankinpollination.com.garyrankin.com"] [uri "/.env.development"] [unique_id "ahl7Y4EMUKj9a2EJcxrbQgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-05-29 10:05:57
(1 week ago)
Abuse Detected (2)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-28 22:05:44
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-27.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-28 16:36:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 12:36:22.628957 2026] [security2:error] [pid 1263:tid 1263] [client 64.64.115.36:50735] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tnthandy.com.inetbrain.com"] [uri "/.env.development.local"] [unique_id "ahhvBk2t2-jLusNobF4BEQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 23:05:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 19:05:00.324616 2026] [security2:error] [pid 5567:tid 5567] [client 64.64.115.36:59623] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mobile.hatfulofrain.com"] [uri "/.env.backup"] [unique_id "ahd4nI_JDRgMn4z_nIfGKwAAAB4"], referer: https://www.google.com/search?q=www.mobile.hatfulofrain.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 12:35:38
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 08:35:21.235415 2026] [security2:error] [pid 27598:tid 27598] [client 64.64.115.36:44649] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnwarnock.info"] [uri "/wp-config.php"] [unique_id "ahblCXrutuExWIUWtZwuIgAAABg"], referer: https://www.google.com/search?q=johnwarnock.info
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 11:52:41
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 07:52:26.151733 2026] [security2:error] [pid 4761:tid 4794] [client 64.64.115.36:53065] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.siestakeybch.pwrcoupling.com"] [uri "/.env.local"] [unique_id "ahba-pVuQ0Bd-a6xMe5MdgAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:58:13
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:57:56.435375 2026] [security2:error] [pid 19544:tid 19544] [client 64.64.115.36:60741] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pocosfarm.littlehorndesign.com"] [uri "/.env.dusk.local"] [unique_id "ahZBlJxyAdt4o7nfCmOG-wAAABg"], referer: https://www.google.com/search?q=www.pocosfarm.littlehorndesign.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:22:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:21:59.081760 2026] [security2:error] [pid 23164:tid 23164] [client 64.64.115.36:59297] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "poolservices.com.jhonbens.com"] [uri "/wp-config.php.save"] [unique_id "ahY5J2Umc2OrJWiyz4FJhQAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-26 21:59:31
(1 week ago)
Auto-ban: >3000 req/min op 2026-05-26
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2025-11-28 00:14:51
(6 months ago)
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 19:14:36.048420 2025] [security2:error] [pid 12081:tid 12173] [client 64.64.115.36:43507] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||mail.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.com"] [uri "/test.cgi"] [unique_id "aSjpbFqoRSJMf-tyVxiSlwAAARY"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 09:29:58
(6 months ago)
(mod_security) mod_security (id:212750) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:212750) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 04:29:41.824180 2025] [security2:error] [pid 1321:tid 1321] [client 64.64.115.36:53361] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: onerror= found within REQUEST_URI: /?s=4jz1r3<img \\x22\\x22\\x22><img src=/ onerror=\\x22alert(document.domain)\\x22></img>/vvr/"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.nbcnewsradio.com"] [uri "/"] [unique_id "aRWlBVFe2nOs-XZRLHztcwAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 02:17:54
(10 months ago)
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 22:17:48.601013 2025] [security2:error] [pid 729657:tid 729700] [client 64.64.115.36:55829] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||autoconfig.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.kettlehill.com"] [uri "/cgi-bin/stats"] [unique_id "aIWMTBUVDjlJfvQpjEJp2QAAAAY"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 23:14:31
(1 year ago)
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 64.64.115.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 19:14:25.454462 2025] [security2:error] [pid 3730845:tid 3730845] [client 64.64.115.36:46249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||webmail.farmers123.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.farmers123.com"] [uri "/test.cgi"] [unique_id "aDjqUUIoo0NbdoaSYw9tCwAAAAQ"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack