🇺🇸
TPI-Abuse
2026-11-11 22:43:45
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:43:40.626872 2026] [security2:error] [pid 7483:tid 7483] [client 151.243.141.87:43626] M ...
show more
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:43:40.626872 2026] [security2:error] [pid 7483:tid 7483] [client 151.243.141.87:43626] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.simplemodernstyle.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.simplemodernstyle.com"] [uri "/CookieAuth.dll"] [unique_id "avTvnGqA7PjRZoHpqN54XwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-11 01:28:56
UTC ·
(1 day ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇨🇿
Prcek
2026-11-10 21:47:12
UTC ·
(1 day ago)
PortScan:HOST=151.243.141.87,DPORTS=80,443
Port Scan
🇧🇪
cmbplf
2026-11-10 17:40:17
UTC ·
(1 day ago)
32 requests with url.path *.dll
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-10 15:41:41
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:41:37.424677 2026] [security2:error] [pid 30111:tid 30111] [client 151.243.141.87:13329] ...
show more
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 10:41:37.424677 2026] [security2:error] [pid 30111:tid 30111] [client 151.243.141.87:13329] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.toddshelton.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.toddshelton.com"] [uri "/CookieAuth.dll"] [unique_id "avM7MTG5AXog2-plcsCHxQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-10 12:50:14
UTC ·
(2 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-10 12:23:04
UTC ·
(2 days ago)
151.243.141.87 - - [10/Nov/2026:13:22:54 +0100] "GET /owa/auth/logon.aspx/ HTTP/1.1" 301 603 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:55 +0100] "GET /owa/auth/logon.a ...
show more
151.243.141.87 - - [10/Nov/2026:13:22:54 +0100] "GET /owa/auth/logon.aspx/ HTTP/1.1" 301 603 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:55 +0100] "GET /owa/auth/logon.aspx/ HTTP/1.1" 404 4485 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:55 +0100] "GET /owa/ HTTP/1.1" 301 571 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:56 +0100] "GET /owa/ HTTP/1.1" 404 4485 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:56 +0100] "GET /OWA/ HTTP/1.1" 301 571 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0"
151.243.141.87 - - [10/Nov/2026:13:22:57 +0100] "GET /OWA/ HTTP/1.1" 404 4486 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100
show less
Bad Web Bot
🇺🇸
kosada.com
2026-11-10 08:52:17
UTC ·
(2 days ago)
Repeated requests for suspicious nonexistent URLs, for example: /owa/auth/logon.aspx (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36")
Web App Attack
🇧🇪
cmbplf
2026-11-10 06:37:04
UTC ·
(2 days ago)
20 requests with url.path *.dll
Brute-Force
Bad Web Bot
2026-10-26 05:44:13
UTC ·
(2 weeks ago)
IP matched detection query 404 icewarp.
Brute-Force
Hacking
🇧🇪
cmbplf
2026-10-26 00:38:07
UTC ·
(2 weeks ago)
29 requests with url.path *.dll
Brute-Force
Bad Web Bot
🇧🇪
cmbplf
2026-10-25 16:45:41
UTC ·
(2 weeks ago)
16 requests with url.path *.dll
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-25 16:32:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:31:55.289717 2026] [security2:error] [pid 12022:tid 12022] [client 151.243.141.87:0] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:31:55.289717 2026] [security2:error] [pid 12022:tid 12022] [client 151.243.141.87:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.looksllc.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.looksllc.com"] [uri "/CookieAuth.dll"] [unique_id "at4u-yHS7vQUEHS87zpSBwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 10:02:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:02:43.673159 2026] [security2:error] [pid 26854:tid 26854] [client 151.243.141.87:12932] ...
show more
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:02:43.673159 2026] [security2:error] [pid 26854:tid 26854] [client 151.243.141.87:12932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.zarslaw.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.zarslaw.com"] [uri "/CookieAuth.dll"] [unique_id "at3Tw0VXDDklZZuhWP968QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 04:18:10
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 00:18:05.156686 2026] [security2:error] [pid 25020:tid 25020] [client 151.243.141.87:37730] ...
show more
(mod_security) mod_security (id:210730) triggered by 151.243.141.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 00:18:05.156686 2026] [security2:error] [pid 25020:tid 25020] [client 151.243.141.87:37730] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.vicknairlaw.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.vicknairlaw.com"] [uri "/CookieAuth.dll"] [unique_id "at2C_dlPc8p2nxT2GhLoyAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
