🇺🇸
TPI-Abuse
2026-10-18 08:25:14
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:25:10.224874 2026] [security2:error] [pid 15239:tid 15239] [client 172.69.151.187:14275] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gardnercastle.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gardnercastle.com"] [uri "/backup.sql"] [unique_id "atSCZhAOutV3xy16_LZyUAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:58:10
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:58:06.486880 2026] [security2:error] [pid 15428:tid 15428] [client 172.69.151.187:9708] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||theholleys.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "theholleys.net"] [uri "/db.sql"] [unique_id "atRt_ojyO8yo2pZrh9guegAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:44:27
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:44:19.988389 2026] [security2:error] [pid 7439:tid 7439] [client 172.69.151.187:14142] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||handmrenovationsllc.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "handmrenovationsllc.com"] [uri "/config.php.bak"] [unique_id "atROoxsECM_vrTHnngO0cAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-18 00:30:33
(3 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php ...
show more
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1, /wp-admin/install.php. Blocked at the edge.
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-17 23:38:25
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:38:19.379683 2026] [security2:error] [pid 1884:tid 1889] [client 172.69.151.187:10639] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sea2er.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sea2er.com"] [uri "/config.php.bak"] [unique_id "atQG68QBl4RhxYZdrzKcjQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-17 18:30:45
(3 days ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-13 23:57:36
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:57:29.468775 2026] [security2:error] [pid 30549:tid 30549] [client 172.69.151.187:10454] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||musiclipsapp.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "musiclipsapp.com"] [uri "/musiclipsapp.sql"] [unique_id "as7FaYQZRWH3QDNpXahiVwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-30 16:45:52
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-21 15:44:46
(4 weeks ago)
Web App Attack
🇧🇪
madeit
2026-08-14 10:47:16
(2 months ago)
Web App Attack
🇷🇺
DZBOT
2026-08-09 07:41:14
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇷🇺
DZBOT
2026-07-11 09:53:00
(3 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 06:30:39
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.69.151.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 02:30:34.511049 2026] [security2:error] [pid 2000:tid 2000] [client 172.69.151.187:11068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lacycustombuilt.com"] [uri "/.git/config"] [unique_id "aiz5CpubTASgSBGCpU2lRQAAADE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-07 18:01:17
(4 months ago)
Fail2ban jail=webexploits banned IP=172.69.151.187 after 1 hits. Reason=web probing.
Brute-Force
Web App Attack
🇫🇮
inlink.ltd
2026-06-06 23:00:01
(4 months ago)
dot file probe
Web App Attack
