🇩🇪
klaus_ph
2026-10-24 08:47:00
(18 hours ago)
[Sat Oct 24 10:46:59.870544 2026] [php:error] [pid 2671155] [client 172.68.192.184:9337] script '/va ...
show more
[Sat Oct 24 10:46:59.870544 2026] [php:error] [pid 2671155] [client 172.68.192.184:9337] script '/var/www/html/login.php' not found or unable to stat
...
show less
Brute-Force
🇮🇹
Inartis
2026-10-23 02:25:46
(2 days ago)
172.68.192.184 - - [23/Oct/2026:04:25:45 +0200] "GET /administrator/ HTTP/1.1" 200 51156 "-" "Mozill ...
show more
172.68.192.184 - - [23/Oct/2026:04:25:45 +0200] "GET /administrator/ HTTP/1.1" 200 51156 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-21 18:07:21
(3 days ago)
Web App Attack
🇩🇪
raph
2026-10-18 19:00:37
(6 days ago)
[Wordpress] crawler /wp-admin/*, /wp-content/*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:14:56
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:14:53.004421 2026] [security2:error] [pid 23168:tid 23168] [client 172.68.192.184:11046] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coolerboxes.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coolerboxes.com"] [uri "/coolerboxes.sql"] [unique_id "atTUXQu9WlGFCL3Jag4X6gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:39:52
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:39:47.175050 2026] [security2:error] [pid 18922:tid 18922] [client 172.68.192.184:9351] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||radtraininginc.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "radtraininginc.net"] [uri "/rezerv.sql"] [unique_id "atST4zoKMfWlZxeQxvEENQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
www.tana.it
2026-10-18 06:22:23
(6 days ago)
PHP scan
Web App Attack
🇬🇧
Smish
2026-10-18 06:01:05
(6 days ago)
HONEYPOT HIT --> Fail2ban time=1792303264 log=2026-10-18T07:01:04+01:00 ip=172.68.192.184 host=in02. ...
show more
HONEYPOT HIT --> Fail2ban time=1792303264 log=2026-10-18T07:01:04+01:00 ip=172.68.192.184 host=in02.bya.ac method=GET uri="/db.sql" status=404 ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" ref="-" rid=30b8bf6a440c23c4b1074fe72e7a78b4
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:35:09
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:35:00.858504 2026] [security2:error] [pid 28245:tid 28245] [client 172.68.192.184:12772] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||atidysort.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atidysort.com"] [uri "/atidysort.com.sql"] [unique_id "atQ-ZALymGZXwi-fcYo-ZwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:05:58
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:949110) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:05:50.959960 2026] [security2:error] [pid 10196:tid 10196] [client 172.68.192.184:11721] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "maricotippett.com"] [uri "/dump.sql"] [unique_id "atQbbizwfDr-J099uMoPVAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:30:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:30:00.021090 2026] [security2:error] [pid 5999:tid 5999] [client 172.68.192.184:13139] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kithouse.org|F|2"] [data ".org.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kithouse.org"] [uri "/kithouse.org.sql"] [unique_id "atPo2Id-5x2Ec9Zu8CZ5ZQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:00:16
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:00:07.988397 2026] [security2:error] [pid 23283:tid 23283] [client 172.68.192.184:11537] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||debosden.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "debosden.com"] [uri "/dump.sql"] [unique_id "atPTx05GNfeOvL_CFW2UfgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-17 10:14:29
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-15 12:37:39
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 02:44:35
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 22:44:30.441779 2026] [security2:error] [pid 17096:tid 17096] [client 172.68.192.184:9534] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jdeloa.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jdeloa.com"] [uri "/jdeloa.com.sql"] [unique_id "atA-DjeGOVHkiTmhnNbJ9AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
