🇮🇹
OLDM
2026-10-24 17:11:20
UTC ·
(2 weeks ago)
Automated clients observed on 24 October 2026, 18:04-19:04 Europe/Rome: between 41 and 498 successful public listing and business detail page requests per client in 1 hour, with no page scripts executed. Repeated HTTP-only crawling confirmed by indep ...
show more
Automated clients observed on 24 October 2026, 18:04-19:04 Europe/Rome: between 41 and 498 successful public listing and business detail page requests per client in 1 hour, with no page scripts executed. Repeated HTTP-only crawling confirmed by independent access-log aggregation.
show less
Bad Web Bot
2025-11-14 07:47:39
UTC ·
(11 months ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-11-13 13:57:25
UTC ·
(11 months ago)
(mod_security) mod_security (id:220150) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 08:57:21.360929 2025] [security2:error] [pid 13795:tid 13795] [client 104.239.22.66:32773] M ...
show more
(mod_security) mod_security (id:220150) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 08:57:21.360929 2025] [security2:error] [pid 13795:tid 13795] [client 104.239.22.66:32773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||ftp.nbcnewsradio.com|F|2"] [data "-1unionselectmd5(999999999)#"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ftp.nbcnewsradio.com"] [uri "/admin/ajax/avatar.php"] [unique_id "aRXjwT2Yh2UcRGdaKvxayAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 02:05:15
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 22:05:13.013367 2025] [security2:error] [pid 729657:tid 729697] [client 104.239.22.66:48015] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 22:05:13.013367 2025] [security2:error] [pid 729657:tid 729697] [client 104.239.22.66:48015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staging.kettlehill.com"] [uri "/.env"] [unique_id "aIWJWRUVDjlJfvQpjEJfqQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 22:06:01
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:05:55.721357 2025] [security2:error] [pid 3616542:tid 3616542] [client 104.239.22.66:5118 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.239.22.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:05:55.721357 2025] [security2:error] [pid 3616542:tid 3616542] [client 104.239.22.66:51187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.farmers123.com"] [uri "/.env.production"] [unique_id "aDjaQ446avo4UTXWkAB0ygAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-03-25 04:35:49
UTC ·
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
2025-03-13 05:56:15
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-03-05 23:09:42
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-02-28 19:40:05
UTC ·
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
2025-02-24 10:43:49
UTC ·
(1 year ago)
Illegal actions on webapp
Hacking
Web App Attack
2025-02-23 17:59:34
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-02-15 08:25:31
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-02-07 14:57:37
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-01-30 16:49:20
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
2025-01-19 11:11:35
UTC ·
(1 year ago)
alibaba cloud ddos like web scan
Bad Web Bot
