🇷🇺
sms.ru
2026-07-03 07:29:09
(1 day ago)
/login.php?r=/etc/passwd
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 04:52:35
(1 day ago)
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 00:52:27.252371 2026] [security2:error] [pid 10982:tid 10982] [client 117.32.137.250:16081] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||infolinkqr.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /index.php?page=\\x22><script>alert(string.fromcharcode(88,83,83))</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "infolinkqr.com"] [uri "/index.php"] [unique_id "akdACxdye0wwwSRul8Pg7wAAAA4"], referer: https://infolinkqr.com/index.php?page="><script >alert(String.fromCharCode(88,83,83))</script>
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-03 01:18:04
(1 day ago)
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 21:17:58.224266 2026] [security2:error] [pid 27730:tid 27730] [client 117.32.137.250:13359] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||pages4you.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /magicart/?c=\\x22><script>alert(string.fromcharcode(88,83,83))</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "pages4you.com"] [uri "/Magic Art/"] [unique_id "akcNxgZyW8nzIxY7FY1AtgAAAAY"], referer: http://pages4you.com/Magic Art/?C="><script >alert(String.fromCharCode(88,83,83))</script>
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
SkyDancer
2026-07-03 00:25:45
(1 day ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-07-02 18:10:48
(1 day ago)
(mod_security) mod_security (id:211190) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 14:10:40.200768 2026] [security2:error] [pid 7580:tid 7580] [client 117.32.137.250:17245] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||westernmassaa.net|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /locations/st-marks-episcopal-church/?tsml-attendance_option=/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "westernmassaa.net"] [uri "/locations/st-marks-episcopal-church/"] [unique_id "akapoMVVXq9oH_eYcLbbgwAAABA"], referer: https://westernmassaa.net/locations/st-marks-episcopal-church/?tsml-attendance_option=/etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 17:36:03
(1 day ago)
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 13:35:58.595692 2026] [security2:error] [pid 12242:tid 12242] [client 117.32.137.250:13660] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||vrmapping.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /?c=\\x22><script>alert(string.fromcharcode(88,83,83))</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "vrmapping.net"] [uri "/"] [unique_id "akahfsmfVryEI47bztxA3AAAAAc"], referer: http://vrmapping.net/?C="><script >alert(String.fromCharCode(88,83,83))</script>
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-07-02 15:38:38
(2 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 15:32:26
(2 days ago)
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 117.32.137.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 11:32:17.090060 2026] [security2:error] [pid 22209:tid 22209] [client 117.32.137.250:14085] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "3"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||dovka.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /ships-blog.html/feed/?c=\\x22><script>alert(string.fromcharcode(88,83,83))</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "dovka.com"] [uri "/ships-blog.html/feed/"] [unique_id "akaEgbuQ3pGrDM8h3QZSFwAAABU"], referer: http://dovka.com/ships-blog.html/feed/?C="><script >alert(String.fromCharCode(88,83,83))</script>
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
IrisFlower
2023-01-16 06:05:42
(3 years ago)
Unauthorized connection attempt detected from IP address 117.32.137.250 to port 443 [J]
Port Scan
Hacking