🇳🇱
Alt255
2026-10-18 09:43:27
(5 hours ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 172.71.144.44 - - [18/Oct/2026:11:43:15 +0200] "GET /backup.sql HTTP/1.1" 301 576 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:46:57
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:46:50.939941 2026] [security2:error] [pid 22707:tid 22715] [client 172.71.144.44:9498] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.killasgarage.bike|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.killasgarage.bike"] [uri "/database.sql"] [unique_id "atR5apX80mtr72cbc03M7AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-10-18 04:12:24
(11 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-18T04:11:05.000Z.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:29:49
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:29:45.629877 2026] [security2:error] [pid 7163:tid 7163] [client 172.71.144.44:10077] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holdingfamily.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holdingfamily.com"] [uri "/db.sql"] [unique_id "atQS-SaENQkWX2EsEhlPGQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
on-com
2026-10-18 00:25:38
(15 hours ago)
URL scan
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 00:24:10
(15 hours ago)
[18/Oct/2026:03:24:09 +0300] -- 172.71.144.44 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-c ...
show more
[18/Oct/2026:03:24:09 +0300] -- 172.71.144.44 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/plugins/bricksforge/readme.txt HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:48:24
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:48:17.373034 2026] [security2:error] [pid 24759:tid 24759] [client 172.71.144.44:13032] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||dantobinlaw.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dantobinlaw.com"] [uri "/database.sql"] [unique_id "atQJQf4CWbB8E5RCElJ6LAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:21:28
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:21:18.753194 2026] [security2:error] [pid 2412:tid 2412] [client 172.71.144.44:9975] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wryemusings.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wryemusings.com"] [uri "/rezerv.sql"] [unique_id "atPYvuTIXpiaKP4TxHETtQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-17 18:30:35
(21 hours ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php ...
show more
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1. Blocked at the edge.
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-15 04:05:16
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 00:05:07.927038 2026] [security2:error] [pid 30056:tid 30056] [client 172.71.144.44:11665] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||firstclasstreatment.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "firstclasstreatment.com"] [uri "/db.sql"] [unique_id "atBQ81yStR5xicTqq1e6vQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-14 12:30:43
(4 days ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-14 03:53:23
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:53:17.488788 2026] [security2:error] [pid 3378:tid 3378] [client 172.71.144.44:10345] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rlysue.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rlysue.com"] [uri "/rlysue.sql"] [unique_id "as78rWr7_lps6Vu2e1S8XAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:36:36
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:36:32.029935 2026] [security2:error] [pid 10695:tid 10695] [client 172.71.144.44:12420] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||atelier92.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atelier92.com"] [uri "/atelier92.sql"] [unique_id "as74wJAVyXecLMTk7YsvbgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:58:27
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:58:19.753125 2026] [security2:error] [pid 28436:tid 28436] [client 172.71.144.44:9519] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.register-yacht-guernsey.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.register-yacht-guernsey.com"] [uri "/db.sql"] [unique_id "as7hu3AtDR_7sTz_x-Q5lAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:05:59
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:05:54.762301 2026] [security2:error] [pid 12296:tid 12296] [client 172.71.144.44:11654] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||estatemartinc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "estatemartinc.com"] [uri "/rezerv.sql"] [unique_id "as7VconLOxZZputmSBH-MAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
