🇺🇸
TPI-Abuse
2026-10-18 13:55:47
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:55:42.894113 2026] [security2:error] [pid 25373:tid 25373] [client 172.68.192.161:14213] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||brennanarchitecture.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "brennanarchitecture.com"] [uri "/backup.sql"] [unique_id "atTP3sHQ9LsMrl7yBw70VwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:43:43
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:43:36.852901 2026] [security2:error] [pid 21907:tid 21907] [client 172.68.192.161:11091] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||towardthesky.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "towardthesky.com"] [uri "/dump.sql"] [unique_id "atS--LM7gOmhX1AEUv5fgQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:02:55
(9 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:02:50.739951 2026] [security2:error] [pid 12334:tid 12334] [client 172.68.192.161:12429] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||stablechase.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stablechase.com"] [uri "/db.sql"] [unique_id "atR9KgVAwbMxa9-4Elo2rgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-16 23:33:52
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 00:19:05
(4 days ago)
[14/Oct/2026:03:19:03 +0300] -- 172.68.192.161 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[14/Oct/2026:03:19:03 +0300] -- 172.68.192.161 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /edu.tar.gz HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 05:51:04
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.192.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:50:58.978207 2026] [security2:error] [pid 24854:tid 24854] [client 172.68.192.161:14140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.unwaved.com"] [uri "/.git/config"] [unique_id "as3Gws2dIhOZpR1GlIMLxQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-02 08:11:28
(2 weeks ago)
Web App Attack
2026-09-28 12:14:22
(2 weeks ago)
Blocked by UFW [443/tcp] | SPT: 9588 | TTL: 56 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefin ...
show more
Blocked by UFW [443/tcp] | SPT: 9588 | TTL: 56 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇳🇱
Alt255
2026-09-18 14:47:43
(1 month ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 172.68.192.161 - - [18/Sep/2026:16:47:27 +0200] "GET /.env.backup HTTP/2.0" 404 4597 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"
...
show less
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-08 07:17:48
(1 month ago)
Web App Attack
🇺🇸
MPL
2026-09-05 05:25:59
(1 month ago)
tcp/443 (5 or more attempts)
Port Scan
2026-08-31 00:54:23
(1 month ago)
Aggressive web scan
Web App Attack
2026-08-29 03:59:41
(1 month ago)
Aggressive web scan
Web App Attack
🇧🇪
madeit
2026-08-23 11:03:55
(1 month ago)
Web App Attack
🇺🇸
mawan
2026-08-22 04:16:37
(1 month ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
