🇺🇸
TPI-Abuse
2025-12-29 18:44:44
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 13:44:35.203328 2025] [security2:error] [pid 22841:tid 23018] [client 154.6.87.16:60007] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kettlehill.com"] [uri "/wp-config.php.orig"] [unique_id "aVLME7vqJPp5jxktaSFxCAAAAM4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 09:44:26
(6 months ago)
(mod_security) mod_security (id:210410) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210410) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 04:44:04.910195 2025] [security2:error] [pid 20887:tid 20887] [client 154.6.87.16:36935] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:skin outside range: 1-255. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||ftp.nbcnewsradio.com|F|3"] [data "ARGS:skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "ftp.nbcnewsradio.com"] [uri "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx TemplateMsg.js.zgz"] [unique_id "aRWoZEfIxym1PkBMYWa8NQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 02:06:57
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 22:06:49.496500 2025] [security2:error] [pid 729660:tid 729773] [client 154.6.87.16:47853] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.com"] [uri "/theme/META-INF/prototype\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xafwindows/win.ini"] [unique_id "aIWJuTL-HxGlFOvlGaU4HAAAAJI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 23:57:25
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 19:57:18.436892 2025] [security2:error] [pid 3791967:tid 3791967] [client 154.6.87.16:55495] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.farmers123.com"] [uri "/.env.production.local"] [unique_id "aDj0Xln1C3OUm8v7dSgCQgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-19 03:14:02
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210730) triggered by 154.6.87.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 18 23:13:52.982606 2025] [security2:error] [pid 7553:tid 7567] [client 154.6.87.16:33433] [client 154.6.87.16] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.spinningdesigns.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.spinningdesigns.com"] [uri "/MyErrors.log"] [unique_id "aAMU8H_M9TFpSRNsjaQXTQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-26 08:40:02
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇩🇪
Fusl
2024-02-22 03:42:37
(2 years ago)
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary ...
show more
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary_36634_955049941.4911300020854"
MIME-Version: 1.0
From: Jessica Joseph <[email protected] >
To: cynthia <[email protected] >
Subject: Subject: Immediate Action Required [ #ID:9CV872YGVWR3X28 ]
Date: Thu, 22 Feb 2024 03:42:15 GMT
Message-Id: <[email protected] >
------=_Boundary_36634_955049941.4911300020854
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
CgrigIoKQ2hhc2XCrgoKRGVhciB2YWx1ZWQgY3VzdG9tZXIsCldlIGhvcGUgdGhpcyBtZXNzYWdl
IGZpbmRzIHlvdSB3ZWxsLiBXZSBhcmUgcmVhY2hpbmcgb3V0IHRvIGluZm9ybSB5b3UgdGhhdCB3
ZSByZXF1aXJlIHNvbWUgYWRkaXRpb25hbCBpbmZvcm1hdGlvbiByZWdhcmRpbmcgeW91ciBiYW5r
IGFjY291bnQuIEluIG9yZGVyIHRvIGVuc3VyZSB0aGUgc2VjdXJpdHkgYW5kIHNtb290aCBmdW5j
dGlvbmluZyBvZiB5b3VyIGFjY291bnQsIHdlIGtpbmRseSByZXF1ZXN0IHlvdSB0byBwcm92aWRl
IHVzIHdpdGggdGhlIGZvbGxvd2luZyBkZXRhaWxzOgpQbGVhc2UgYmUgYXNzdXJlZCB0aGF0IGFs
bCBpbmZvcm1hdGlvbiBwcm92aWRlZCB3aW
show less
Email Spam
🇩🇪
Fusl
2024-02-21 02:36:47
(2 years ago)
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary ...
show more
received unsolicited smtp data stream:
Content-Type: multipart/alternative; boundary="----=_Boundary_47876_134326588.2532254638250"
MIME-Version: 1.0
From: Alyssa Velasquez <[email protected] >
To: b.strong <[email protected] >
Subject: Subject: Immediate Action Required [ #ID:Z3KXZK6YLZ81ZBV ]
Date: Wed, 21 Feb 2024 02:36:30 GMT
Message-Id: <[email protected] >
------=_Boundary_47876_134326588.2532254638250
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
New email | Test email sent from Beefree | beefree.io/appJ.P Morgan Services
=E2=80=8A
Dear Customer,
We regret to inform you that
there may have been a potential breach of your account. Our team
has detected some unusual activity, and we take this matter very
seriously.
To ensure the security of
your account, we kindly request that you take immediate action.
Please log in to your account and review your recent transactions
and activit
show less
Email Spam
🇷🇸
Smel
2024-01-29 13:04:05
(2 years ago)
Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -
Email Spam
Hacking
Brute-Force
🇳🇱
trentwiles.com
2023-09-16 19:07:46
(2 years ago)
Unauthorized connection attempt detected from IP address 154.6.87.16 to port 8080 [AMS]
Port Scan
Hacking
🇺🇸
GeekOnTheHill
2023-07-07 20:12:19
(2 years ago)
Web-based SQL injection attempt
Hacking
SQL Injection
Web App Attack
🇪🇸
10dencehispahard SL
2023-02-09 22:25:42
(3 years ago)
Suspicious activity detected by Modsecurity [Suspicious IP found on 24 servers 46 times. Reincident ...
show more
Suspicious activity detected by Modsecurity [Suspicious IP found on 24 servers 46 times. Reincident by 0. Rules:]
show less
Web App Attack
🇿🇦
IrisFlower
2023-01-15 01:10:24
(3 years ago)
Unauthorized connection attempt detected from IP address 154.6.87.16 to port 204 [J]
Port Scan
Hacking
🇿🇦
IrisFlower
2023-01-15 00:52:46
(3 years ago)
Unauthorized connection attempt detected from IP address 154.6.87.16 to port 204 [J]
Port Scan
Hacking
🇿🇦
IrisFlower
2023-01-15 00:36:37
(3 years ago)
Unauthorized connection attempt detected from IP address 154.6.87.16 to port 204 [J]
Port Scan
Hacking