🇺🇸
TPI-Abuse
2026-10-24 12:38:25
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 08:38:20.191767 2026] [security2:error] [pid 31186:tid 31186] [client 172.71.144.160:10186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coyotebytes.com"] [uri "/.git/config"] [unique_id "atymvDgTMPkh4yao2vYmhQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-24 00:57:46
(17 hours ago)
[24/Oct/2026:03:57:46 +0300] -- 172.71.144.160 Ban reason: Scanner [CMS_GENERIC] | Request: GET /adm ...
show more
[24/Oct/2026:03:57:46 +0300] -- 172.71.144.160 Ban reason: Scanner [CMS_GENERIC] | Request: GET /administrator/ HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇩🇪
bescared
2026-10-24 00:35:54
(17 hours ago)
F2B - Malicious activity detected. URL Probing. -8ff06ede-
Hacking
Bad Web Bot
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-24 00:27:22
(17 hours ago)
172.71.144.160 - - [23/Oct/2026:18:27:22 -0600] "GET /wp-login.php HTTP/1.1" 301 487 "-" "Mozilla/5. ...
show more
172.71.144.160 - - [23/Oct/2026:18:27:22 -0600] "GET /wp-login.php HTTP/1.1" 301 487 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
...
show less
Web App Attack
🇳🇱
Tsumugi Kotobuki
2026-10-21 04:59:00
(3 days ago)
Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 52 | Len: 60B | Win: ...
show more
Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 52 | Len: 60B | Win: 65535(1) | F2B/ufw-honeypot@2026-10-21T04:59:00Z
show less
Port Scan
Hacking
🇫🇷
dynamix
2026-10-20 23:58:54
(3 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:25:54
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:25:46.301308 2026] [security2:error] [pid 2808:tid 2808] [client 172.71.144.160:14016] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jerusalem-temple-today.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jerusalem-temple-today.com"] [uri "/db.sql"] [unique_id "atSQmvZjrk8lhvFJlXJlQQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:17:57
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:17:54.770622 2026] [security2:error] [pid 26492:tid 26492] [client 172.71.144.160:11166] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||daebakdesign.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "daebakdesign.com"] [uri "/config.php.bak"] [unique_id "atRyogpuKx9ZNSp72ibj_AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-10-18 01:46:53
(6 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:16:03
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:15:51.174148 2026] [security2:error] [pid 14155:tid 14155] [client 172.71.144.160:13271] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||precjoza.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "precjoza.com"] [uri "/rezerv.sql"] [unique_id "atQPtxRRsYrP3oQMKPWABgAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
borbolla
2026-10-17 21:01:26
(6 days ago)
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp-admin/install.php?step ...
show more
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp-admin/install.php?step=1 HTTP/2.0"
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-15 05:28:15
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:28:08.660441 2026] [security2:error] [pid 774:tid 774] [client 172.71.144.160:12777] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cyber507.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cyber507.net"] [uri "/db.sql"] [unique_id "atBkaG6n6YQON-eqdKDuaQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 00:12:45
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 20:12:38.461123 2026] [security2:error] [pid 19278:tid 19278] [client 172.71.144.160:11119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||jvcsat.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jvcsat.com"] [uri "/jvcsat.com.sql"] [unique_id "atAadiG34plwba8BghGbqwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-14 11:54:53
(1 week ago)
Multiple WAF Violations
Web App Attack
🇬🇧
Yosi
2026-10-14 07:15:41
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
