|
Anonymous
|
|
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
|
Brute-Force
SSH
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212620) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 06:04:09.797381 2025] [security2:error] [pid 1372:tid 1372] [client 104.239.90.166:45787] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /wp-content/plugins/pdf-generator-for-wp/package/lib/dompdf/vendor/dompdf/dompdf/i18n/arabic/examples/query.php?keyword=\\x22><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.nbcnewsradio.com"] [uri "/wp-content/plugins/pdf-generator-for-wp/package/lib/dompdf/vendor/dompdf/dompdf/I18N/Arabic/Examples/Query.php"] [unique_id "aRW7KWfAsh5bZRr8lvjV3wAAAA0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:221260) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:221260) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:49:53.945115 2025] [security2:error] [pid 404368:tid 404600] [client 104.239.90.166:54281] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||webdisk.kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kettlehill.net"] [uri "/cgi-bin/test"] [unique_id "aIV3sasKpTtRNU_PZbqLRAAAAFU"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
|
Brute-Force
SSH
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:30:36.052225 2025] [security2:error] [pid 3652582:tid 3652582] [client 104.239.90.166:33759] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.farmers123.com"] [uri "/.env.live"] [unique_id "aDjgDFhHagVK1oImTz34tAAAAAY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
alibaba cloud ddos like web scan
|
Bad Web Bot
|
|
|
Anonymous
|
|
Illegal actions on webapp
|
Hacking
Web App Attack
|
|
|
Anonymous
|
|
alibaba cloud ddos like web scan
|
Bad Web Bot
|
|
|
Anonymous
|
|
| A web attack returned code 200 (success).
|
Hacking
SQL Injection
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212790) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212790) triggered by 104.239.90.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 27 09:14:56.148899 2025] [security2:error] [pid 26779:tid 26845] [client 104.239.90.166:50279] [client 104.239.90.166] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\s\\\\x22'](?:alert|eval|\\\\.fromcharcode)\\\\s?(?:\\\\(|`)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "72"] [id "212790"] [rev "5"] [msg "COMODO WAF: XSS Attack Detected||mail.kettlehill.net|F|2"] [data "Matched Data: 'alert( found within REQUEST_URI: /dashboard/snapshot/{{constructor.constructor('alert(document.domain)')()}}?orgid=1"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "mail.kettlehill.net"] [uri "/dashboard/snapshot/{{constructor.constructor('alert(document.domain)')()}}"] [unique_id "Z8BzYDoJrweMv3EjNi7ZaQAAABc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
ignores robots.txt
|
Bad Web Bot
|
|
|
Anonymous
|
|
alibaba cloud ddos like web scan
|
Bad Web Bot
|
|
|
Anonymous
|
|
ignores robots.txt
|
Bad Web Bot
|
|
|
Anonymous
|
|
alibaba cloud ddos like web scan
|
Bad Web Bot
|
|
|
Anonymous
|
|
alibaba cloud ddos like web scan
|
Bad Web Bot
|
|