2026-09-03 03:07:48
(2 hours ago)
Trying to access config files
Web App Attack
🇺🇸
RH5
2026-09-01 23:37:48
(1 day ago)
User-agent blocked via advanced UA rule (paros). UTC 2026-09-01 23:37
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-01 23:28:33
(1 day ago)
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 19:28:29.283590 2026] [security2:error] [pid 2605:tid 2605] [client 104.244.74.156:3212] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||cliniquecavalancia.com|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "cliniquecavalancia.com"] [uri "/wp-content/plugins/events-manager/readme.txt"] [unique_id "apdfnXPABsQHMH3Hs6VgBQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 23:03:34
(1 day ago)
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 19:03:29.605451 2026] [security2:error] [pid 5855:tid 5855] [client 104.244.74.156:20346] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||doctoredwinalvarez.com|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "doctoredwinalvarez.com"] [uri "/wp-content/plugins/events-manager/readme.txt"] [unique_id "apdZwSzDZ0MjCsdejyJ7LQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 22:42:27
(1 day ago)
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:210801) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 18:42:18.861171 2026] [security2:error] [pid 27105:tid 27105] [client 104.244.74.156:4504] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||cienmalos.com|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "cienmalos.com"] [uri "/wp-content/plugins/events-manager/readme.txt"] [unique_id "apdUyoHjTEiyd3h6ZlSUCwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 09:24:12
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:24:05.090057 2026] [security2:error] [pid 17012:tid 17012] [client 104.244.74.156:38279] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||doublenaughtspycar.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "doublenaughtspycar.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "apaZtXVSnDA11N0NMja-0AAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
stinpriza
2026-09-01 09:18:51
(1 day ago)
Web App Attack
Web App Attack
2026-09-01 09:06:04
(1 day ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:50:17
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:50:12.034186 2026] [security2:error] [pid 17822:tid 17822] [client 104.244.74.156:64525] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cosplayculture.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cosplayculture.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "apaRxFTamqr1xrUo5A1YPQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 08:11:30
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the la ...
show more
(mod_security) mod_security (id:225170) triggered by 104.244.74.156 (lux.neonshell.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:11:22.047247 2026] [security2:error] [pid 13365:tid 13365] [client 104.244.74.156:50482] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.ironsightsarmory.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.ironsightsarmory.com"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "apaIqmoWEqBwW5W3THG7dgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Kenshin869
2026-09-01 07:36:07
(1 day ago)
Wordpress unauthorized access attempt
Brute-Force