|
Anonymous
|
|
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
|
Exploited Host
|
|
🇨🇱
Fernando Soto
|
|
WAF propio vps1 (CL): 404x26,sensMASx113,SECRET200x2 score 38 en 1h. sondeo rutas sensibles, barrido 404.
|
Port Scan
Web App Attack
|
|
🇿🇦
conure.sh
|
|
csagent: score 19.7: 404 noise floor x39, secrets grab x1; 1 domain(s) in 1s
|
Web App Attack
|
|
🇬🇧
thetomtaylor.co.uk
|
|
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice01,ice02]
|
Hacking
SQL Injection
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:46:29.614577 2026] [security2:error] [pid 5902:tid 5 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:46:29.614577 2026] [security2:error] [pid 5902:tid 5936] [client 34.152.16.205:55104] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||strengthsmatter.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "strengthsmatter.com"] [uri "/z9x8c7v6b5-debug-trigger-strengthsmatter.com"] [unique_id "ashVhJvARnNEQ7SSMIN5vwAAAEU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇵🇱
strefapi_com
|
|
Brute-force, web
...
|
Hacking
Brute-Force
Web App Attack
|
|
🇳🇱
middelkoopcc
|
|
2026-10-09 04:29:01 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-09 04:29:01 GET /build../.env [301] && 2026-10-09 04:29:01 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 162 more within 20 minutes
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:18:32.190959 2026] [security2:error] [pid 7770:tid 7 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:18:32.190959 2026] [security2:error] [pid 7770:tid 7770] [client 34.152.16.205:56452] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||streamlinenz.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "streamlinenz.com"] [uri "/z9x8c7v6b5-debug-trigger-streamlinenz.com"] [unique_id "ashO-C_Q1QQxv9nVknZ98AAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:01:36.190684 2026] [security2:error] [pid 5828:tid 5 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.152.16.205 (205.16.152.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:01:36.190684 2026] [security2:error] [pid 5828:tid 5828] [client 34.152.16.205:40406] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||strawberryhillchristmas.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "strawberryhillchristmas.com"] [uri "/z9x8c7v6b5-debug-trigger-strawberryhillchristmas.com"] [unique_id "ashLAO9I0nQgYOKwbGNkywAAACM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
Petros Stefanakis
|
|
(mod_security) mod_security triggered on hostname [redacted] 34.152.16.205 (CA/Canada/205.16.152.34.bc.googleusercontent.com)
|
SQL Injection
|
|
🇫🇷
masterguru
|
|
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-193)
show less
|
Hacking
|
|
🇺🇸
WellSpring
|
|
env leak on strangertable.org/dist../.env — WellSpr.ing/NetSentinel civic-AI security layer
|
Web App Attack
|
|
🇳🇱
WeCloudit-Anti-Abuse
|
|
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
|
Web App Attack
Hacking
|
|
🇩🇪
EGP Abuse Dept
|
|
Scanning for web/db/file exploits on www.straatweginstallateur.nl
|
SQL Injection
Bad Web Bot
Web App Attack
|
|
🇬🇧
thetomtaylor.co.uk
|
|
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [wa01,wa02]
|
Hacking
SQL Injection
Web App Attack
|
