🇩🇪
FeG Deutschland
2026-10-18 13:27:43
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:46:10
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:46:00.826731 2026] [security2:error] [pid 32312:tid 32312] [client 162.158.110.191:9702] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||creektech.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "creektech.com"] [uri "/db.sql"] [unique_id "atPsmPo6IaUY3ocIG7q0PQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:45:50
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:45:40.029759 2026] [security2:error] [pid 32083:tid 32083] [client 162.158.110.191:10806] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||stationrestaurant.ca|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stationrestaurant.ca"] [uri "/admin/config.php.bak"] [unique_id "atPedLPzVD-PxZb0UfKlbQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bescared
2026-10-14 02:22:00
(5 days ago)
WAF (2) - Malicious activity detected: URL probing.
Bad Web Bot
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-13 22:07:34
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:07:29.260884 2026] [security2:error] [pid 25647:tid 25647] [client 162.158.110.191:10508] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jamiesbballpool.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jamiesbballpool.com"] [uri "/jamiesbballpool.com.sql"] [unique_id "as6roeiv96h9N-zyTduuswAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-01 11:33:23
(2 weeks ago)
Web App Attack
🇷🇺
DZBOT
2026-09-05 03:43:23
(1 month ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
MPL
2026-07-30 07:21:54
(2 months ago)
tcp/443 (5 or more attempts)
Port Scan
🇧🇷
chronos
2026-07-30 05:27:13
(2 months ago)
2026-07-30 01:05:42 UTC-3||Unauthorized connection attempt detected for port scanning
Port Scan
🇺🇸
TPI-Abuse
2026-06-17 13:39:00
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 09:38:51.539775 2026] [security2:error] [pid 32665:tid 32665] [client 162.158.110.191:12954] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "editions.click.dandemonium.net"] [uri "/.git/config"] [unique_id "ajKja5ixntYMxf1LWs3wogAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 22:39:32
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:39:24.332444 2026] [security2:error] [pid 23604:tid 23604] [client 162.158.110.191:13212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "quintanotariaconcepcion.cl.tecnoconce.com"] [uri "/.git/config"] [unique_id "ais5HJGPKIw97mT5CvhzrgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 08:30:04
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 04:29:59.847118 2026] [security2:error] [pid 31583:tid 31590] [client 162.158.110.191:10269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "360degreevalue.com"] [uri "/.git/config"] [unique_id "ah6Uh06pQhF2w6aJ1M-zMQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
DZBOT
2026-05-31 15:52:36
(4 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 10:55:56
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.110.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 06:55:53.071136 2026] [security2:error] [pid 4622:tid 4652] [client 162.158.110.191:12222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fiefseigneur.com"] [uri "/.git/config"] [unique_id "af3BOYzEo0ZF2kOg5A5lEQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
acadeova
2026-04-21 22:08:54
(5 months ago)
🚨 Recon detected (nft drop)
SRC=162.158.110.191
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(jou ...
show more
🚨 Recon detected (nft drop)
SRC=162.158.110.191
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
