🇺🇸
TPI-Abuse
2026-09-02 20:33:13
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.r ...
show more
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 16:33:08.838240 2026] [security2:error] [pid 26369:tid 26369] [client 109.252.124.168:2219] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||walkerweb.com|F|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "walkerweb.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apiIBM42cA_b0OkfXDQxWgAAAB4"], referer: https://walkerweb.com/administrator/manifests/packages/pkg_sourcerer.xml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sorgin Informatique
2026-09-02 14:58:57
(9 hours ago)
soe-1 : Trying access unauthorized files=>/administrator/manifests/packages/pkg_sourcerer.xml
Hacking
2026-09-02 09:37:04
(14 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇷🇺
DZBOT
2026-09-02 00:05:28
(1 day ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇨🇭
4server
2026-09-01 22:04:18
(1 day ago)
[WedSep0200:04:15.0448302026][security2:error][pid893912:tid894586][client109.252.124.168:0]ModSecur ...
show more
[WedSep0200:04:15.0448302026][security2:error][pid893912:tid894586][client109.252.124.168:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hostingedomini.ch\"][uri\"/media/sourcerer/js/popup.js\"][unique_id\"apdL3-LJVYM6tu90xZNoAAAAAMo\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 20:32:45
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.r ...
show more
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 16:32:40.224765 2026] [security2:error] [pid 26580:tid 26580] [client 109.252.124.168:2775] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||guitarsouth.com|F|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "guitarsouth.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apc2aMHIM-xgi4tqkqyu6QAAACc"], referer: https://guitarsouth.com/administrator/manifests/packages/pkg_sourcerer.xml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
marten_o
2026-09-01 18:55:26
(1 day ago)
109.252.124.168 - - [01/Sep/2026:20:55:26 +0200] "GET /tmp/376376.ph$p HTTP/1.1" 500 574 "https://bl ...
show more
109.252.124.168 - - [01/Sep/2026:20:55:26 +0200] "GET /tmp/376376.ph$p HTTP/1.1" 500 574 "https://blumental-server.de/index.php?option=com_jce&task=profiles.import" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2682.38 Safari/537.36" 1197 1133
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 14:39:13
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.r ...
show more
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 10:39:08.522871 2026] [security2:error] [pid 11321:tid 11321] [client 109.252.124.168:2313] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||disenowebprofesional.com|F|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "disenowebprofesional.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apbjjDJ1x8bbE7hgW49CugAAAAE"], referer: https://disenowebprofesional.com/administrator/manifests/packages/pkg_sourcerer.xml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 14:10:52
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.r ...
show more
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 10:10:47.792670 2026] [security2:error] [pid 8373:tid 8373] [client 109.252.124.168:3409] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||deserttrails.net|F|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "deserttrails.net"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apbc52txb9KRf6bxk0pZkgAAAEs"], referer: https://deserttrails.net/administrator/manifests/packages/pkg_sourcerer.xml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-09-01 13:29:50
(1 day ago)
lae- 404 : Too many 404 errors
Brute-Force
2026-09-01 06:30:08
(1 day ago)
| [Dangerous/Russia] Aggressive IP 109.252.124.168 (~30 hits). Type: DoS Defender- Web server 400 er ...
show more
| [Dangerous/Russia] Aggressive IP 109.252.124.168 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-09-01 04:15:46
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.r ...
show more
(mod_security) mod_security (id:210730) triggered by 109.252.124.168 (109-252-124-168.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:15:42.992059 2026] [security2:error] [pid 15732:tid 15732] [client 109.252.124.168:3416] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aarce.me|F|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aarce.me"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apZRbvJXdNvSgZTTInCZBAAAACQ"], referer: https://aarce.me/administrator/manifests/packages/pkg_sourcerer.xml
show less
Brute-Force
Bad Web Bot
Web App Attack