🇺🇸
TPI-Abuse
2026-07-05 16:35:48
(5 days ago)
(mod_security) mod_security (id:220020) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:220020) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 12:35:41.754263 2026] [security2:error] [pid 29882:tid 29882] [client 150.251.225.167:40707] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(^|;)=(;|$)" at REQUEST_HEADERS:Cookie. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "74"] [id "220020"] [rev "2"] [msg "COMODO WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||matterofbritain.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "matterofbritain.com"] [uri "/"] [unique_id "akqH3aQkb9m-MdQ77bxEGAAAABI"], referer: http://qwhb168.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-05 13:01:12
(5 days ago)
(mod_security) mod_security (id:220020) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:220020) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 09:01:06.163535 2026] [security2:error] [pid 18366:tid 18366] [client 150.251.225.167:47451] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(^|;)=(;|$)" at REQUEST_HEADERS:Cookie. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "74"] [id "220020"] [rev "2"] [msg "COMODO WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||www.thesteeldrumman.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thesteeldrumman.com"] [uri "/"] [unique_id "akpVkrk-Skpu0ylQzWdNOAAAAAU"], referer: https://mayak-centr.ru
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-07-01 12:09:32
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 17:04:53
(3 weeks ago)
(mod_security) mod_security (id:949110) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:949110) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 13:04:46.361033 2026] [security2:error] [pid 11980:tid 11980] [client 150.251.225.167:40693] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sh-llc.net"] [uri "/license.txt"] [unique_id "ai2NrpXh5mm-1lL0lhmW4QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
anon333
2026-06-13 16:36:11
(3 weeks ago)
Invalid HTTP port 80 probes to server T1236
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-06-13 16:21:26
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 12:21:19.687954 2026] [security2:error] [pid 28137:tid 28137] [client 150.251.225.167:49781] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||ehrlichfamily.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "ehrlichfamily.net"] [uri "/license.txt"] [unique_id "ai2Df4e98eNmwa2zMjDbkAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 14:26:00
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 10:25:53.181082 2026] [security2:error] [pid 2137:tid 2137] [client 150.251.225.167:26549] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||vaccines4all.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "vaccines4all.net"] [uri "/license.txt"] [unique_id "ai1ocYYjad5gvz-7pJWSQAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 10:56:38
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 06:56:32.113871 2026] [security2:error] [pid 10266:tid 10266] [client 150.251.225.167:39707] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||webtony.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "webtony.net"] [uri "/license.txt"] [unique_id "ai03YNBoKNrlfjfuezZy5QAAAG8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 04:41:24
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 00:41:17.477461 2026] [security2:error] [pid 8228:tid 8228] [client 150.251.225.167:65003] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||designsbyyvonne.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "designsbyyvonne.net"] [uri "/license.txt"] [unique_id "aizfbSJ2gog5g526nAI1HwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 02:00:00
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 21:59:53.649933 2026] [security2:error] [pid 23960:tid 24107] [client 150.251.225.167:49461] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||www.biblewriter.com|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "www.biblewriter.com"] [uri "/license.txt"] [unique_id "aiy5mRsgCiAxSokYqj2ujgAAARU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 23:50:23
(3 weeks ago)
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210801) triggered by 150.251.225.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 19:50:19.320875 2026] [security2:error] [pid 2083:tid 2083] [client 150.251.225.167:58507] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||radiointernational.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "radiointernational.net"] [uri "/license.txt"] [unique_id "aiybO37Hbygh0SAOT-4cVAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack