🇺🇸
TPI-Abuse
2026-05-27 22:43:55
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:210730) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 18:43:31.576500 2026] [security2:error] [pid 11335:tid 11335] [client 67.227.113.154:54559] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||m.gatheringsattheschool.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "m.gatheringsattheschool.com"] [uri "/terraform.tfstate.backup"] [unique_id "ahdzk-sH0RCz1NMWHlNWIgAAAAE"], referer: https://www.google.com/search?q=m.gatheringsattheschool.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 15:42:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 11:42:20.569896 2026] [security2:error] [pid 13823:tid 13823] [client 67.227.113.154:33255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fritsknuf.com"] [uri "/.env.dev"] [unique_id "ahcQ3PfAaDzrbnDXoxCIZAAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 00:25:06
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 20:24:57.230875 2026] [security2:error] [pid 10735:tid 10735] [client 67.227.113.154:48797] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.notify.ev.alitcogroup.com"] [uri "/wp-config.php"] [unique_id "ahY52clwRl2VZZPq8tGcXQAAAAc"], referer: https://www.google.com/search?q=www.notify.ev.alitcogroup.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 18:16:06
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 14:12:54.210970 2026] [security2:error] [pid 6421:tid 6421] [client 67.227.113.154:46585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mountararattrek.com.amybeam.com"] [uri "/.env.development.local"] [unique_id "ahXipk-7_Az4iChhfgQvLAAAAAM"], referer: https://www.google.com/search?q=www.mountararattrek.com.amybeam.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-26 17:11:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:210492) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 13:11:19.524860 2026] [security2:error] [pid 20375:tid 20375] [client 67.227.113.154:33029] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "railfairofseo.com"] [uri "/.env.dev"] [unique_id "ahXUN_2CyYvQZL7N2pT84QAAABc"], referer: https://www.google.com/search?q=railfairofseo.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-05-26 17:06:03
(1 week ago)
[TueMay2619:05:56.5114372026][security2:error][pid2832562:tid2832759][client67.227.113.154:0]ModSecu ...
show more
[TueMay2619:05:56.5114372026][security2:error][pid2832562:tid2832759][client67.227.113.154:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.cybertelgroup.com.81-17-25-250.cpanel.site\"][uri\"/.env.development\"][unique_id\"ahXS9EM_3Lw1w5tfiBPK2QAAAI4\"]\,referer:https://www.google.com/search\?q=www.cybertelgroup.com.81-17-25-250.cpanel.site
show less
Hacking
Web App Attack
2026-01-24 16:57:50
(4 months ago)
Malicious activity detected
Hacking
Web App Attack
2024-11-27 04:10:11
(1 year ago)
| A web attack returned code 200 (success).
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2024-11-26 23:26:25
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationA ...
show more
(mod_security) mod_security (id:211190) triggered by 67.227.113.154 (67.227.113.154.rdns.ColocationAmerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 26 18:25:52.857833 2024] [security2:error] [pid 14716:tid 14991] [client 67.227.113.154:33579] [client 67.227.113.154] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.kettlehill.net|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kettlehill.net"] [uri "/install/lib/ajaxHandlers/ajaxServerSettingsChk.php"] [unique_id "Z0ZZAAhXN1-tm_FGp0dg7gAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Alejandro Docasar
2024-11-26 18:11:51
(1 year ago)
Web App Attack
🇩🇪
dayda.net
2024-11-22 03:48:40
(1 year ago)
query: rest_route=/wp/v2/users
Bad Web Bot