🇺🇸
TPI-Abuse
2026-11-10 01:51:18
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:51:09.602282 2026] [security2:error] [pid 22115:tid 22115] [client 172.69.150.217:12120] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:51:09.602282 2026] [security2:error] [pid 22115:tid 22115] [client 172.69.150.217:12120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fixmywellwater.com"] [uri "/wp-config.php"] [unique_id "avJ4jdc1NtzypdzSoAhnQgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-11-09 09:22:02
UTC ·
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇩🇪
FD-IX
2026-11-07 20:14:10
UTC ·
(5 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-11-06 17:07:16
UTC ·
(6 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. Observed by 1 sensor(s); 1 hits.
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-11-02 14:34:13
UTC ·
(1 week ago)
{"level":"info","ts":1793630046.8372777,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.69.150.217","remote_port":"13479","client_ip":"172.69.150.217","proto":"HTTP/1.1","method":"GET","host":"status2.mikegreco.com ...
show more
{"level":"info","ts":1793630046.8372777,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.69.150.217","remote_port":"13479","client_ip":"172.69.150.217","proto":"HTTP/1.1","method":"GET","host":"status2.mikegreco.com","uri":"/wp-content/plugins/hellopress/wp_filemanager.php","headers":{"X-Forwarded-For":["20.218.73.251"],"Cf-Connecting-Ip":["20.218.73.251"],"Cf-Ipcountry":["DE"],"Connection":["Keep-Alive"],"Cf-Ray":["a543dbb0bc2e5d9f-FRA"],"Cdn-Loop":["cloudflare; loops=1"],"X-Forwarded-Proto":["https"],"Accept-Encoding":["gzip, br"],"Cf-Visitor":["{\"scheme\":\"https\"}"]}},"bytes_read":0,"user_id":"","duration":0.000132763,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status2.mikegreco.com/wp-content/plugins/hellopress/wp_filemanager.php"],"Content-Type":[]}}
{"level":"info","ts":1793630046.969564,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.69.150.217","rem
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 14:24:16
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:24:10.026373 2026] [security2:error] [pid 7016:tid 7016] [client 172.69.150.217:12736] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:24:10.026373 2026] [security2:error] [pid 7016:tid 7016] [client 172.69.150.217:12736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.gbcwoodbine.org"] [uri "/wp-config.php.old"] [unique_id "auidCoyCfJVWoiW-W0ijLwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-29 05:42:41
UTC ·
(2 weeks ago)
Web App Attack
🇲🇽
octageeks.com
2026-10-25 04:22:08
UTC ·
(2 weeks ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-24 07:53:33
UTC ·
(2 weeks ago)
[24/Oct/2026:10:53:32 +0300] -- 172.69.150.217 Ban reason: Scanner [CMS_GENERIC] | Request: GET /xmlrpc.php HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-19 18:30:49
UTC ·
(3 weeks ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-18 01:48:48
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:48:40.743738 2026] [security2:error] [pid 1384:tid 1384] [client 172.69.150.217:9922] Mo ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:48:40.743738 2026] [security2:error] [pid 1384:tid 1384] [client 172.69.150.217:9922] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coyotepoet.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coyotepoet.com"] [uri "/admin/config.php.bak"] [unique_id "atQleGbDB8FfqPN753dEQQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:17:28
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:17:17.742677 2026] [security2:error] [pid 27841:tid 27841] [client 172.69.150.217:13139] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:17:17.742677 2026] [security2:error] [pid 27841:tid 27841] [client 172.69.150.217:13139] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||amazingwelding.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "amazingwelding.com"] [uri "/db.sql"] [unique_id "atQeHQzMndi-U4Mu_SE3zAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:02:01
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:01:53.964357 2026] [security2:error] [pid 10973:tid 10973] [client 172.69.150.217:12525] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.150.217 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:01:53.964357 2026] [security2:error] [pid 10973:tid 10973] [client 172.69.150.217:12525] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||eclipsesoftware.andrew.weigel.name|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eclipsesoftware.andrew.weigel.name"] [uri "/rezerv.sql"] [unique_id "atQMce6SslZk02hxrrMNPQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-17 01:47:36
UTC ·
(3 weeks ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-02 14:34:17
UTC ·
(1 month ago)
Web App Attack
