🇫🇷
dynamix
2026-10-20 21:38:06
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:07:16
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:07:08.529380 2026] [security2:error] [pid 16121:tid 16121] [client 172.68.195.231:9334] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.havilahmalone.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.havilahmalone.com"] [uri "/havilahmalone.sql"] [unique_id "atR-LPyKZpQkKPgtNSAISwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:19:29
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:19:21.870194 2026] [security2:error] [pid 22229:tid 22229] [client 172.68.195.231:10514] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||agkgt.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "agkgt.org"] [uri "/config.php.bak"] [unique_id "atQemaWTUFWoN0Gvzx7agAAAADY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
tecnicorioja
2026-10-15 22:01:12
(6 days ago)
wp-login attack [15/Oct/2026:14:41:48
Brute-Force
Web App Attack
🇧🇪
madeit
2026-10-15 02:37:04
(1 week ago)
Web App Attack
🇫🇷
tecnicorioja
2026-10-14 22:00:35
(1 week ago)
wp-login attack [14/Oct/2026:12:48:29
Brute-Force
Web App Attack
2026-10-09 15:30:58
(1 week ago)
(caddyscan) Scanner path probe from 172.68.195.231 (DE/Germany/-): 5 in the last 3600 secs; Ports: * ...
show more
(caddyscan) Scanner path probe from 172.68.195.231 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.68.195.231 - - [09/Oct/2026:15:30:56 +0000] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env HTTP/1.1"
[REDACTED] 200 2627 172.68.195.231 - - [09/Oct/2026:15:30:56 +0000] "GET /cache/original/%2e%2e/.env HTTP/1.1"
[REDACTED] 200 2627 172.68.195.231 - - [09/Oct/2026:15:30:56 +0000] "GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1"
[REDACTED] 200 2627 172.68.195.231 - - [09/Oct/2026:15:30:56 +0000] "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/1.1"
[REDACTED] 200 2627 172.68.195.231 - - [09/Oct/2026:15:30:56 +0000] "GET /api/system/fileView?file=/app/.env HTTP/1.1"
show less
Port Scan
🇫🇷
dynamix
2026-10-08 06:22:16
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇫🇮
iamxorum
2026-09-12 15:36:39
(1 month ago)
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-12T15:36:38.49 ...
show more
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-12T15:36:38.493984+00:00 XRM-01 kernel: [588036.917005] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=172.68.195.231 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=39941 DF PROTO=TCP SPT=14299 DPT=8443 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇩🇪
abdubhai
2026-09-07 01:20:09
(1 month ago)
172.68.195.231 - - [07/Sep/2026:
...
Brute-Force
🇳🇱
middelkoopcc
2026-08-17 18:10:04
(2 months ago)
2026-08-17 20:02:46 GET /app_dev.php/_profiler/open?file=app/.env [404] && 2026-08-17 20:02:47 GET / ...
show more
2026-08-17 20:02:46 GET /app_dev.php/_profiler/open?file=app/.env [404] && 2026-08-17 20:02:47 GET /app_dev.php/_profiler/open?file=.env [404] && 2026-08-17 20:02:50 GET /app/.env [404] && 165 more within 20 minutes
show less
Web App Attack
🇧🇪
madeit
2026-08-16 22:06:48
(2 months ago)
Web App Attack
🇩🇪
palla89
2026-08-03 02:22:44
(2 months ago)
(wordpress) Failed wordpress login from 172.68.195.231 (DE/Germany/-)
Brute-Force
🇧🇷
mateus.vicente
2026-07-30 23:59:35
(2 months ago)
[2026-07-30T23:59:35Z] Requests to sensitive Apache endpoints and path traversal patterns. (srv-app)
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-12 12:12:59
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.68.195.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 08:12:53.027922 2026] [security2:error] [pid 20646:tid 20646] [client 172.68.195.231:9425] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "w-c-p-m.com"] [uri "/.git/config"] [unique_id "alOExdMlqUQ8o0csIc0uBwAAAAM"], referer: https://www.google.com/search?q=w-c-p-m.com
show less
Brute-Force
Bad Web Bot
Web App Attack