🇩🇪
paissangroup
2026-06-26 02:21:12
(23 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 21:00:32
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 17:00:23.865140 2026] [security2:error] [pid 6183:tid 6183] [client 154.201.65.94:55490] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.waggonerfinancial.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.waggonerfinancial.com"] [uri "/okok.cer"] [unique_id "aj2W58R7h8WL46N1UrkjYQAAAAg"], referer: https://www.waggonerfinancial.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 18:43:39
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 14:43:35.009573 2026] [security2:error] [pid 32568:tid 32568] [client 154.201.65.94:36890] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.wadenelson.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.wadenelson.com"] [uri "/okok.cer"] [unique_id "aj121wMkHFJOdXLSjjDuVwAAAA8"], referer: https://www.wadenelson.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 05:20:09
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 01:20:00.043173 2026] [security2:error] [pid 10263:tid 10263] [client 154.201.65.94:49330] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kclawoffice.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kclawoffice.com"] [uri "/okok.cer"] [unique_id "ajtpAH-4reZYbiNfyj3EsgAAAAg"], referer: https://kclawoffice.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-23 18:27:45
(3 days ago)
Web vulnerability probing: /fun.aspx
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 13:59:28
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 09:59:22.549350 2026] [security2:error] [pid 8526:tid 8526] [client 154.201.65.94:49640] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||curts.net|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "curts.net"] [uri "/okok.cer"] [unique_id "ajqROquKm_rRuArJTuiP2gAAAAo"], referer: https://curts.net/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-20 09:18:34
(6 days ago)
FortiWeb WAF: 503 attacks detected. Threat Score: 50400. Types: Block IP List(252), Client Managemen ...
show more
FortiWeb WAF: 503 attacks detected. Threat Score: 50400. Types: Block IP List(252), Client Management(251). Origin: Hong Kong.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 13:23:51
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 09:23:46.172104 2026] [security2:error] [pid 21183:tid 21183] [client 154.201.65.94:50764] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pennylanefarmsauces.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pennylanefarmsauces.com"] [uri "/okok.cer"] [unique_id "ajVC4iOKFKqAvgrPSkzX7AAAAAg"], referer: https://pennylanefarmsauces.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-19 09:04:12
(1 week ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: Webs ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: Webshell probing
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 16:20:27
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:20:20.148205 2026] [security2:error] [pid 25139:tid 25139] [client 154.201.65.94:59888] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.golflavahotsprings.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.golflavahotsprings.com"] [uri "/okok.cer"] [unique_id "ajAmRLLzkWvxXQRI0MJfBgAAAAQ"], referer: https://www.golflavahotsprings.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 09:12:23
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:12:16.304813 2026] [security2:error] [pid 16469:tid 16469] [client 154.201.65.94:52582] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.goldenvalley1.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.goldenvalley1.com"] [uri "/okok.cer"] [unique_id "ai_B8K1sU11UMv0NkliJYwAAAAE"], referer: https://www.goldenvalley1.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 19:58:15
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 15:58:11.823995 2026] [security2:error] [pid 6783:tid 6783] [client 154.201.65.94:41612] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||snowrideadventures.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "snowrideadventures.com"] [uri "/okok.cer"] [unique_id "ai8H0792ot0uSmcj1CU0LQAAAAk"], referer: https://snowrideadventures.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 18:20:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 14:20:11.884781 2026] [security2:error] [pid 25729:tid 25729] [client 154.201.65.94:50748] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||snowflakeinvitations.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "snowflakeinvitations.com"] [uri "/okok.cer"] [unique_id "ai7w20MEtMmYf7nsBvXIkgAAAAY"], referer: https://snowflakeinvitations.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 05:17:43
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 01:17:35.969523 2026] [security2:error] [pid 7662:tid 7693] [client 154.201.65.94:54882] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||driftwoodblue.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "driftwoodblue.com"] [uri "/okok.cer"] [unique_id "aizn733qb-9_gYnN42tZcgAAAcE"], referer: https://driftwoodblue.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-04 09:32:44
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 154.201.65.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 05:32:36.976007 2026] [security2:error] [pid 27090:tid 27090] [client 154.201.65.94:45620] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||healingtrek.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "healingtrek.com"] [uri "/okok.cer"] [unique_id "aiFGNMeEWEYEj4VmjLMjuQAAAAU"], referer: https://healingtrek.com/okok.cer
show less
Brute-Force
Bad Web Bot
Web App Attack