🇩🇪
4server
2026-10-18 07:27:08
(1 day ago)
[SunOct1809:27:02.8958152026][security2:error][pid3648270:tid3648321][client172.68.195.154:0]ModSecu ...
show more
[SunOct1809:27:02.8958152026][security2:error][pid3648270:tid3648321][client172.68.195.154:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"mail.giuliani.li\"][uri\"/giuliani.sql\"][unique_id\"atR0xiz_1k9ggUi5BswPGwAAAE0\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:48:20
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:48:14.953105 2026] [security2:error] [pid 30749:tid 30749] [client 172.68.195.154:14065] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tduniverse.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tduniverse.net"] [uri "/backup.sql"] [unique_id "atRPjs0q9MJa3h2Dt1dt4AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:29:40
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:29:28.636550 2026] [security2:error] [pid 20410:tid 20410] [client 172.68.195.154:13019] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.deals.directnic-support.rocks|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.deals.directnic-support.rocks"] [uri "/directnic-support.sql"] [unique_id "atRLKNBqFzG2ipw9NHU7_QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:57:00
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:56:53.185938 2026] [security2:error] [pid 3641:tid 3648] [client 172.68.195.154:12565] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||reclaimingspirituality.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "reclaimingspirituality.com"] [uri "/rezerv.sql"] [unique_id "atP9NUvwT-cVoWzFoRztyAAAAIM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-17 22:23:32
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇫🇷
Pays d'Angoulême
2026-10-17 07:44:51
(2 days ago)
[Drupal AbuseIPDB module] Request path is blacklisted. /wp-admin/core/install.php
Web App Attack
🇩🇪
findlab
2026-10-15 04:30:09
(4 days ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 13:14:13
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:14:09.492965 2026] [security2:error] [pid 9438:tid 9458] [client 172.68.195.154:13523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adt-sales.com.exede-sales.com"] [uri "/.git/config"] [unique_id "as-AIX8Qqjn7-mgrRJMYBgAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:33:58
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:33:49.275057 2026] [security2:error] [pid 14792:tid 14792] [client 172.68.195.154:10806] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vesalappi.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vesalappi.com"] [uri "/database.sql"] [unique_id "as74Hf716VpQCw6KU5HITgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
LMAS
2026-10-13 22:27:22
(5 days ago)
HTTP honeypot request observed. Inferred classification: Unclassified/Wildcard Probe. Path: /dump.zi ...
show more
HTTP honeypot request observed. Inferred classification: Unclassified/Wildcard Probe. Path: /dump.zip
show less
Brute-Force
Web App Attack
🇧🇪
madeit
2026-10-09 05:38:44
(1 week ago)
Web App Attack
🇳🇴
jad-abuse
2026-09-11 03:07:33
(1 month ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. Observed by 1 sensor(s); 3 hits.
show less
Brute-Force
Web App Attack
🇧🇪
madeit
2026-09-03 06:42:03
(1 month ago)
Web App Attack
🇸🇪
nekopavel
2026-09-02 01:18:50
(1 month ago)
172.68.195.154 - - [02/Sep/2026:03:18:48 +0200]"GET /xmlrpc.php HTTP/1.1" 301 162"-" thighs.moe "Moz ...
show more
172.68.195.154 - - [02/Sep/2026:03:18:48 +0200]"GET /xmlrpc.php HTTP/1.1" 301 162"-" thighs.moe "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36""0.000" "-""Frankfurt am Main" "DE"
172.68.195.154 - - [02/Sep/2026:03:18:48 +0200]"GET /xmlrpc.php HTTP/1.1" 301 162"https://thighs.moe/xmlrpc.php" thighs.moe "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0""0.000" "-""Frankfurt am Main" "DE"
172.68.195.154 - - [02/Sep/2026:03:18:49 +0200]"GET /xmlrpc.php HTTP/1.1" 301 162"https://thighs.moe/xmlrpc.php" thighs.moe "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0""0.000" "-""Frankfurt am Main" "DE"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-08-07 19:37:38
(2 months ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. Observed by 1 sensor(s); 2 hits.
show less
Brute-Force
Web App Attack
