🇧🇪
voormedia
2026-06-04 19:45:49
(4 days ago)
Accessed trap at '/.aws/credentials'
Web App Attack
🇺🇸
mnsf
2026-05-28 22:07:04
(1 week ago)
Scanning/Probing (24)
Brute-Force
Web App Attack
🇳🇱
Mangelot Hosting
2026-05-07 23:40:48
(1 month ago)
(bad_user_agent) srv102 Bad User-Agent 65.111.26.63 (ES/Spain/-): 10 in the last 3600 secs; Ports: * ...
show more
(bad_user_agent) srv102 Bad User-Agent 65.111.26.63 (ES/Spain/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇨🇭
TheCoon
2026-04-21 12:30:01
(1 month ago)
Automated: Gzip bomb download attempt
Web App Attack
Hacking
🇳🇱
i-turnradio.nl
2026-04-11 13:45:07
(1 month ago)
2026-04-11 @ 15:45:06 (CET) ~ Blocked for trying to access: /erker/wp/wp-login.php
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 00:59:52
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:59:48.381266 2025] [security2:error] [pid 6357:tid 6357] [client 65.111.26.63:42365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "carl-fink.cafink.name"] [uri "/.git/HEAD"] [unique_id "aSZRBKFzeT9x3Kb9iiXiFAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
jjnxpct
2025-11-25 04:54:20
(6 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /.env]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 09:46:13
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:46:07.273226 2025] [security2:error] [pid 407:tid 407] [client 65.111.26.63:59031] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.arriagarealestate.com"] [uri "/.git/HEAD"] [unique_id "aSQpX9QFPoCECQm9mwRu7AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 08:43:16
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:43:10.591720 2025] [security2:error] [pid 23504:tid 23504] [client 65.111.26.63:17453] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.partytimegame.com"] [uri "/.env"] [unique_id "aSQanv6FKzTsjVOR9vCQOwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:50:29
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:49:47.570245 2025] [security2:error] [pid 25105:tid 25119] [client 65.111.26.63:47549] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.princesscastlebunkbed.com"] [uri "/.svn/wc.db"] [unique_id "aSQOG8n5O4wpUvSPLAuSwgAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:20:28
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:19:40.607436 2025] [security2:error] [pid 7133:tid 7133] [client 65.111.26.63:17095] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.givemethemic.com"] [uri "/.env"] [unique_id "aSQHDJgD9cayuPceNeKdewAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-17 01:57:53
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 16 20:57:49.272957 2025] [security2:error] [pid 18689:tid 18689] [client 65.111.26.63:13377] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.polymermembranes.com"] [uri "/.env"] [unique_id "aRqBHQYp9frlvEFiXoKvUwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-30 14:37:43
(7 months ago)
WordPress Brute Force
Brute-Force
🇩🇪
Marc
2025-10-29 19:08:29
(7 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2024-12-23 18:22:37
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 65.111.26.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 23 13:22:32.645627 2024] [security2:error] [pid 15642:tid 15754] [client 65.111.26.63:55333] [client 65.111.26.63] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thetooheys.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thetooheys.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z2mqaDDUR9aYQ_Ib0_ZFRwAAANM"], referer: https://thetooheys.com
show less
Brute-Force
Bad Web Bot
Web App Attack