🇺🇸
TPI-Abuse
2026-11-10 13:28:32
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:28:27.316040 2026] [security2:error] [pid 2114:tid 2154] [client 162.158.86.238:9784] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:28:27.316040 2026] [security2:error] [pid 2114:tid 2154] [client 162.158.86.238:9784] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barkdullit.com"] [uri "/wp-config.php.save"] [unique_id "avMb-0lnwd7Z6AfZ_5e7GgAAAQc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
copestack
2026-11-10 02:30:11
UTC ·
(1 day ago)
Honeypot hit on ov-4e5936 (fail2ban jail: nginx-compat)
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-03 22:59:40
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-02.
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-11-03 16:55:21
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 11:55:14.247504 2026] [security2:error] [pid 30699:tid 30699] [client 162.158.86.238:12222] ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 11:55:14.247504 2026] [security2:error] [pid 30699:tid 30699] [client 162.158.86.238:12222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.pronio.com"] [uri "/wp-config.php.old"] [unique_id "auoR8hNXsibjZ412TNt_bAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-31 03:12:25
UTC ·
(1 week ago)
Web App Attack
2026-10-29 22:14:12
UTC ·
(1 week ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-10-25 02:03:52
UTC ·
(2 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-24 06:00:25
UTC ·
(2 weeks ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 162.158.86.238 - - [24/Oct/2026:08:00:09 +0200] "GET /phpinfo.php HTTP/1.1" 301 499 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Geck ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 162.158.86.238 - - [24/Oct/2026:08:00:09 +0200] "GET /phpinfo.php HTTP/1.1" 301 499 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:29:07
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:29:00.323635 2026] [security2:error] [pid 22203:tid 22203] [client 162.158.86.238:13223] ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:29:00.323635 2026] [security2:error] [pid 22203:tid 22203] [client 162.158.86.238:13223] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||livingminimal.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "livingminimal.com"] [uri "/database.sql"] [unique_id "atS7jHMbXK-sm4NXj6PhqgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:07:31
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:07:26.631552 2026] [security2:error] [pid 22337:tid 22337] [client 162.158.86.238:10119] ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:07:26.631552 2026] [security2:error] [pid 22337:tid 22337] [client 162.158.86.238:10119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||leagueloch.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "leagueloch.com"] [uri "/database.sql"] [unique_id "atSaXv5-fULTEAdpI7CTKgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-14 04:47:03
UTC ·
(4 weeks ago)
[WedOct1406:46:57.6762062026][security2:error][pid1996722:tid1996758][client162.158.86.238:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htac ...
show more
[WedOct1406:46:57.6762062026][security2:error][pid1996722:tid1996758][client162.158.86.238:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"traslochiamo.ch\"][uri\"/db.sql\"][unique_id\"as8JQQG4TU7mfq3P2qgXWAAAAFA\"]
show less
Port Scan
Brute-Force
Web App Attack
2026-10-14 03:10:18
UTC ·
(4 weeks ago)
162.158.86.238 - - [14/Oct/2026:03:10:18 +0000] "GET /wp-admin/install.php?step=1 HTTP/1.1" 302 541 "-" "http://ashleybutcher.eu/wp-admin/install.php?step=1"
...
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:02:45
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:02:42.240114 2026] [security2:error] [pid 26586:tid 26586] [client 162.158.86.238:11774] ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:02:42.240114 2026] [security2:error] [pid 26586:tid 26586] [client 162.158.86.238:11774] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bigchus.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bigchus.com"] [uri "/db.sql"] [unique_id "as7w0sOAueF6QgLDtDcYoQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:37:22
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:37:14.753856 2026] [security2:error] [pid 7042:tid 7042] [client 162.158.86.238:10442] M ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.86.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:37:14.753856 2026] [security2:error] [pid 7042:tid 7042] [client 162.158.86.238:10442] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||shannonmatter.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "shannonmatter.com"] [uri "/db.sql"] [unique_id "as6ymjc1snJzR8cOxzWmqAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-10 10:42:00
UTC ·
(1 month ago)
block ruleset bad bot: misc bad content F608233CC4C86EE814CE8DDDA9C4A0D3C79882F6
Bad Web Bot
