🇺🇸
TPI-Abuse
2026-10-18 07:40:58
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:40:52.219195 2026] [security2:error] [pid 21987:tid 21987] [client 172.68.192.180:11143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.iclog.us|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.iclog.us"] [uri "/iclog.sql"] [unique_id "atR4BFGdxRGfZ4-QU7pFQgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:17:29
(23 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:17:20.212383 2026] [security2:error] [pid 4229:tid 4229] [client 172.68.192.180:10914] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||247.fishing|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "247.fishing"] [uri "/db.sql"] [unique_id "atQ6QNVhC3a1g-f65hZpegAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:43:40
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:43:34.390179 2026] [security2:error] [pid 3099:tid 3099] [client 172.68.192.180:12675] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||justkoolit.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "justkoolit.com"] [uri "/backup.sql"] [unique_id "atQkRomQ78BbBpjHd9Lt6AAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:59:30
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:59:21.571830 2026] [security2:error] [pid 20165:tid 20305] [client 172.68.192.180:10283] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ja-parismacau.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ja-parismacau.com"] [uri "/config.php.bak"] [unique_id "atQZ6cIhDdrD4Ou7cP9RoQAAAc8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 00:32:40
(1 day ago)
[18/Oct/2026:03:32:40 +0300] -- 172.68.192.180 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp- ...
show more
[18/Oct/2026:03:32:40 +0300] -- 172.68.192.180 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/plugins/bricksforge/readme.txt HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:05:22
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:05:14.920718 2026] [security2:error] [pid 16632:tid 16710] [client 172.68.192.180:12033] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sparkhypnotherapy.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sparkhypnotherapy.com"] [uri "/rezerv.sql"] [unique_id "atP_Khs7Whj4i0-8fROkuQAAAFY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:51:08
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:51:02.162224 2026] [security2:error] [pid 2541:tid 2541] [client 172.68.192.180:11794] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nuewines.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nuewines.com"] [uri "/nuewines.sql"] [unique_id "atPftr10-Jvh2GOOyWTRMgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-16 08:10:48
(2 days ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-05 01:49:40
(2 weeks ago)
Web App Attack
🇵🇰
sbk97 (https://sayor.net)
2026-10-04 07:42:20
(2 weeks ago)
SAYOR honeypot: observed attack /wordpress/wp-admin/setup-config.php
Brute-Force
🇫🇷
dynamix
2026-10-01 09:08:55
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-09-07 11:43:33
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-30 07:38:47
(1 month ago)
Web App Attack
🇷🇺
DZBOT
2026-08-18 05:59:49
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
xxkodedxx
2026-08-10 22:46:30
(2 months ago)
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10 ...
show more
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10m window.
Origin: DE / AS13335 Cloudflare, Inc.
Active: 22:45:51 UTC
Volume: 1 HTTP req
Probed: /wp-admin/install.php?step=1
Status mix: 444×1
UA: "http://ztx-lab.com/wp-admin/install.php?step=1"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
