🇦🇹
Erpelstolz
2025-11-25 11:24:24
(7 months ago)
VM 131: 104.239.124.17 - - [25/Nov/2025:12:24:22 +0100] "GET /partymgr/control/getJSONuiLabel HTTP/1 ...
show more
VM 131: 104.239.124.17 - - [25/Nov/2025:12:24:22 +0100] "GET /partymgr/control/getJSONuiLabel HTTP/1.1" 404 8450
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-12 19:43:37
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 14:43:31.968934 2025] [security2:error] [pid 7849:tid 7849] [client 104.239.124.17:41409] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nbcnewsradio.com|F|2"] [data ".com.db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nbcnewsradio.com"] [uri "/nbcnewsradio.com.db"] [unique_id "aRTjYwuvv5XTVjzxz5KtrAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 14:45:38
(9 months ago)
(mod_security) mod_security (id:210350) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 10:45:32.844874 2025] [security2:error] [pid 21347:tid 21373] [client 104.239.124.17:34029] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mail.kettlehill.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mail.kettlehill.com"] [uri "/"] [unique_id "aN0-jDQa5dHzoOSVGKqBugAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
raramos
2025-08-07 19:00:07
(11 months ago)
[SMB remote code execution attempt: port tcp/445]
in blocklist.de:'listed [pop3]'
in SpamCop:'listed ...
show more
[SMB remote code execution attempt: port tcp/445]
in blocklist.de:'listed [pop3]'
in SpamCop:'listed'
in sorbs:'listed [web], [spam]'
in Unsubscore:'listed'
*(RWIN=8192)(04:10)
show less
Web Spam
Email Spam
Port Scan
Hacking
Brute-Force
Web App Attack
2025-08-01 14:40:04
(11 months ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 08:01:40
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 04:01:34.652163 2025] [security2:error] [pid 3705323:tid 3705360] [client 104.239.124.17:52971] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kettlehill.com"] [uri "/htaccess_for_page_not_found_redirects.htaccess"] [unique_id "aIx0XlSqWoxQtnj67bcj1QAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 06:26:29
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 02:26:27.004184 2025] [security2:error] [pid 2256137:tid 2256249] [client 104.239.124.17:43043] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.staging.kettlehill.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.staging.kettlehill.com"] [uri "/backup.sql"] [unique_id "aDvyk2Q8Dui5hvebpq-HCAAAANI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-28 20:31:02
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.239.124.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 28 16:30:57.962365 2025] [security2:error] [pid 1859130:tid 1859130] [client 104.239.124.17:43971] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.farmers123.com|F|2"] [data ".old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.farmers123.com"] [uri "/.ssh/known_hosts.old"] [unique_id "aDdygTJEMAdN-cT5sy14-gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2023-08-29 11:45:56
(2 years ago)
Form spam
Web Spam
🇺🇸
oncord
2023-08-16 18:30:02
(2 years ago)
Form spam
Web Spam