🇩🇪
altenglaner
2026-10-18 12:42:39
(4 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:47:33
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:47:24.757337 2026] [security2:error] [pid 6396:tid 6406] [client 172.68.192.192:11071] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||southtampaprinting.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "southtampaprinting.com"] [uri "/rezerv.sql"] [unique_id "atP6_Ic1mEkT0JDHjh2xEAAAAQY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:22:54
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:22:44.568795 2026] [security2:error] [pid 24581:tid 24645] [client 172.68.192.192:10780] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jrc3.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jrc3.com"] [uri "/database.sql"] [unique_id "atP1NPivOdSBJJpDVWl6ygAAAYY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:13:59
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:13:55.088151 2026] [security2:error] [pid 27981:tid 27981] [client 172.68.192.192:9672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.clinicadentaldiaz.aticom.es|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.clinicadentaldiaz.aticom.es"] [uri "/dump.sql"] [unique_id "atPlE8xZhfC_vVWH0doz4AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:06:27
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:06:17.041952 2026] [security2:error] [pid 6148:tid 6148] [client 172.68.192.192:9825] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ballantinepaintinganddrywall.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ballantinepaintinganddrywall.com"] [uri "/db.sql"] [unique_id "atPVOWF0v6YSGA9JpQEujwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 10:28:31
(1 week ago)
[14/Oct/2026:09:09:07 +0300] -- 172.68.192.192 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[14/Oct/2026:09:09:07 +0300] -- 172.68.192.192 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /admin/config.php.bak HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 04:41:12
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:41:05.839298 2026] [security2:error] [pid 3779:tid 3779] [client 172.68.192.192:12558] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cathrynn.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cathrynn.com"] [uri "/db.sql"] [unique_id "as8H4eLAmp5wwPfaoIhUJQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:44:43
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:44:38.307866 2026] [security2:error] [pid 4080:tid 4095] [client 172.68.192.192:9449] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coloradosellers.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coloradosellers.com"] [uri "/config.php.bak"] [unique_id "as7ehlZ_IvFiCjbiqrqR1gAAAY0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:07:37
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:07:29.445275 2026] [security2:error] [pid 8774:tid 8774] [client 172.68.192.192:9735] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kircali.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kircali.net"] [uri "/db.sql"] [unique_id "as7V0Vqh9djlFVnpJo73owAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:50:14
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:50:05.018306 2026] [security2:error] [pid 29269:tid 29269] [client 172.68.192.192:11905] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||redwingboot.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "redwingboot.com"] [uri "/admin/config.php.bak"] [unique_id "as7RvUjxpPp_N6mYQ4m87wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:53:09
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.192.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:53:01.530408 2026] [security2:error] [pid 15229:tid 15229] [client 172.68.192.192:10725] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||fedeolivaperu.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fedeolivaperu.com"] [uri "/db.sql"] [unique_id "as7EXTU3vREr0OpD2zbVZwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-12 15:54:01
(1 week ago)
Web App Attack
🇧🇪
madeit
2026-10-01 12:42:01
(3 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-01 20:28:58
(1 month ago)
Web App Attack
🇷🇺
DZBOT
2026-08-20 01:22:52
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack