🇸🇬
anotherwatcher
2026-10-27 15:46:42
(1 day ago)
bad bot
Bad Web Bot
🇫🇮
iamxorum
2026-10-22 06:50:00
(6 days ago)
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-10-22T06:49:59.017728+00:00 XRM-00 kernel: [2121742.020747] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=162.158.111.166 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=5 ...
show more
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-10-22T06:49:59.017728+00:00 XRM-00 kernel: [2121742.020747] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=162.158.111.166 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=58541 DF PROTO=TCP SPT=12258 DPT=8443 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
dynamix
2026-10-21 02:36:44
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:28:44
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:28:37.123065 2026] [security2:error] [pid 30344:tid 30344] [client 162.158.111.166:1210 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:28:37.123065 2026] [security2:error] [pid 30344:tid 30344] [client 162.158.111.166:12107] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||eclipsesoftware.biz|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eclipsesoftware.biz"] [uri "/rezerv.sql"] [unique_id "atStZSTR5qEMs5U5Iqj5lAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 06:32:00
(1 week ago)
[18/Oct/2026:09:31:59 +0300] -- 162.158.111.166 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /confmanagement-proc.zip HTTP/1.1
Bad Web Bot
Web App Attack
2026-10-18 06:05:05
(1 week ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
🇫🇷
dynamix
2026-10-18 03:09:40
(1 week ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-15 09:08:25
(1 week ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 23:54:47
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:54:40.440473 2026] [security2:error] [pid 22557:tid 22557] [client 162.158.111.166:1060 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:54:40.440473 2026] [security2:error] [pid 22557:tid 22557] [client 162.158.111.166:10603] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.anniesherbals.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.anniesherbals.com"] [uri "/dump.sql"] [unique_id "atAWQHSR3ARQN3b_sc-LUAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:19:38
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:19:29.368904 2026] [security2:error] [pid 21544:tid 21544] [client 162.158.111.166:1242 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:19:29.368904 2026] [security2:error] [pid 21544:tid 21544] [client 162.158.111.166:12422] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||weat.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "weat.net"] [uri "/config.php.bak"] [unique_id "as70wTzU3fIo1efX_vTb-AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-30 11:41:02
(4 weeks ago)
[WedSep3013:40:56.1660932026][security2:error][pid3676919:tid3676998][client162.158.111.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.hta ...
show more
[WedSep3013:40:56.1660932026][security2:error][pid3676919:tid3676998][client162.158.111.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"pietroviviani.ch\"][uri\"/wp-config.php.bak\"][unique_id\"arz1SGwsqE0H3itdyyteuQAAAIg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇧🇪
madeit
2026-09-25 14:04:22
(1 month ago)
Web App Attack
🇩🇪
on-com
2026-09-11 00:11:29
(1 month ago)
URL scan
Brute-Force
Web App Attack
🇩🇪
on-com
2026-09-06 18:16:20
(1 month ago)
URL scan
Brute-Force
Web App Attack
🇧🇪
madeit
2026-09-03 06:42:09
(1 month ago)
Web App Attack
