🇺🇸
TPI-Abuse
2025-09-06 23:24:44
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 19:24:40.166314 2025] [security2:error] [pid 24639:tid 24639] [client 156.233.72.158:35613] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.imaginationbyme.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.imaginationbyme.com"] [uri "/s3cmd.ini"] [unique_id "aLzCuPTE8sYwqWU0OztRSwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 15:47:17
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 11:47:13.978053 2025] [security2:error] [pid 11752:tid 11752] [client 156.233.72.158:56581] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ivoryweddingnapkins.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ivoryweddingnapkins.com"] [uri "/s3cmd.ini"] [unique_id "aLxXgRbvEuaVdPPOk2AsmwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 09:03:44
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 05:03:41.299271 2025] [security2:error] [pid 7687:tid 7687] [client 156.233.72.158:12579] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jbsellsre.burlison.com"] [uri "/config.php%7C/.env%7Csettings.py"] [unique_id "aLv47SX5PsfL-CH-XvIc2AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 03:20:29
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 05 23:20:21.724079 2025] [security2:error] [pid 22914:tid 22914] [client 156.233.72.158:40241] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.innovacionesnimba.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.innovacionesnimba.com"] [uri "/s3cmd.ini"] [unique_id "aLuodWIZCQwQo-5ITiNkPwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 00:33:03
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 05 20:32:58.963360 2025] [security2:error] [pid 28080:tid 28080] [client 156.233.72.158:20053] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eta-mct.com"] [uri "/config.php%7C/.env%7Csettings.py"] [unique_id "aLuBOgjZYDX_yh1bhRBJ2QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob.fr
2025-09-03 02:31:04
(9 months ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇺🇸
TPI-Abuse
2025-09-01 04:25:56
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 01 00:25:50.631916 2025] [security2:error] [pid 9183:tid 9183] [client 156.233.72.158:21357] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.emails.pawzy.app|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.emails.pawzy.app"] [uri "/s3cmd.ini"] [unique_id "aLUgTi5m-YQ_cHnEi8ZbygAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-11 16:02:37
(11 months ago)
(mod_security) mod_security triggered on hostname [redacted] 156.233.72.158 (BR/Brazil/-)
SQL Injection
🇺🇸
VSM Networks
2025-05-31 15:34:40
(1 year ago)
Credential Stuffing
Brute-Force
🇺🇸
TPI-Abuse
2025-05-10 06:44:15
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 10 02:44:08.129398 2025] [security2:error] [pid 2936434:tid 2936455] [client 156.233.72.158:45461] [client 156.233.72.158] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||soonervolunteer.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "soonervolunteer.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aB71uOUHempVxdJLWZ0K5QAAANM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-05-01 09:37:53
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇨🇭
backslash
2025-04-24 06:05:06
(1 year ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
2025-04-17 09:06:59
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇦🇺
MAGIC
2025-03-23 05:12:13
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2025-03-23 05:04:37
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 156.233.72.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 23 01:04:30.730279 2025] [security2:error] [pid 26424:tid 26424] [client 156.233.72.158:19671] [client 156.233.72.158] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||massingale.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "massingale.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z9-WXmzUwmmMxDOMDKOINAAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack