🇺🇸
TPI-Abuse
2026-01-17 18:56:01
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 13:55:56.498528 2026] [security2:error] [pid 13381:tid 13381] [client 138.128.159.194:48853] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/api/.env"] [unique_id "aWvbPP6hQWRR8pSDNlwATAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 21:05:55
(7 months ago)
(mod_security) mod_security (id:210410) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210410) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 16:05:47.716745 2025] [security2:error] [pid 21770:tid 21792] [client 138.128.159.194:55853] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:file outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||www.kettlehill.kettlehill.com|F|3"] [data "ARGS:file=;echo CVE-2023-23333|rev\\x00.zip"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "www.kettlehill.kettlehill.com"] [uri "/downloader.php"] [unique_id "aVLtK-1IUNfWG5lsn0HFnQAAAZM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-29 09:57:06
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 04:56:59.260845 2025] [security2:error] [pid 29290:tid 29441] [client 138.128.159.194:34929] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.com"] [uri "/logs/errors.log"] [unique_id "aSrDa7IpbMsELiP_zDf0fgAAARg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 09:26:43
(9 months ago)
(mod_security) mod_security (id:211190) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:211190) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 04:26:25.822224 2025] [security2:error] [pid 1497:tid 1497] [client 138.128.159.194:45165] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /tarantella/cgi-bin/secure/ttawlogin.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/tarantella/cgi-bin/secure/ttawlogin.cgi/"] [unique_id "aRWkQW6lieQ9qVEOqQJrKwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dayda.net
2025-10-13 03:23:16
(10 months ago)
query: option=com_jinventory&controller=../../../../../../../../../../etc/passwd%00
Bad Web Bot
🇺🇸
TPI-Abuse
2025-07-27 01:10:51
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 21:10:45.311394 2025] [security2:error] [pid 404369:tid 404482] [client 138.128.159.194:45381] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staging.kettlehill.com"] [uri "/sample.htaccess"] [unique_id "aIV8lY1ApCwrT9-Kn8W5wAAAAI0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 18:51:25
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 14:43:45.280521 2025] [security2:error] [pid 3179419:tid 3179419] [client 138.128.159.194:54679] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.farmers123.com"] [uri "/assets../.git/config"] [unique_id "aDiq4faewdTGMWxsGSUD8AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-27 15:00:56
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 138.128.159.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 27 10:00:21.177853 2025] [security2:error] [pid 27063:tid 27212] [client 138.128.159.194:36389] [client 138.128.159.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kettlehill.kettlehill.com"] [uri "/wp-config.php.bak"] [unique_id "Z8B-BcnGgNPGej7DPucVRQAAAIU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-25 09:00:22
(1 year ago)
| A web attack returned code 200 (success).
Hacking
SQL Injection
Web App Attack
🇺🇸
oncord
2023-11-22 05:47:14
(2 years ago)
Form spam
Web Spam