🇸🇬
anotherwatcher
2026-10-21 18:43:52
(1 hour ago)
bad bot
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-18 09:34:38
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:34:28.774843 2026] [security2:error] [pid 7243:tid 7243] [client 172.71.144.65:12975] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pcga.golf|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pcga.golf"] [uri "/database.sql"] [unique_id "atSSpA6XDCfrNirmEMn0ogAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:14:17
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:14:11.703752 2026] [security2:error] [pid 816:tid 816] [client 172.71.144.65:10283] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||yongmeihu.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yongmeihu.com"] [uri "/rezerv.sql"] [unique_id "atR_0xxLrhhWcuAd8c5LEAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:58:38
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:58:31.685835 2026] [security2:error] [pid 31444:tid 31444] [client 172.71.144.65:11925] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.doreenkimura.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.doreenkimura.com"] [uri "/db.sql"] [unique_id "atR8Jz_Im5IXmA7ixQAUJwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:22:47
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:22:43.793646 2026] [security2:error] [pid 22457:tid 22457] [client 172.71.144.65:13912] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.naacd.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.naacd.com"] [uri "/config.php.bak"] [unique_id "atRXowe5Tm4XJjGf_qU7wAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:36:23
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:36:17.464093 2026] [security2:error] [pid 29541:tid 29541] [client 172.71.144.65:14283] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bridgital.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bridgital.com"] [uri "/rezerv.sql"] [unique_id "atQikURDt29WnukwO6d0VwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:25:48
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:25:43.868250 2026] [security2:error] [pid 18617:tid 18622] [client 172.71.144.65:14008] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||e-dome.co.jp|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "e-dome.co.jp"] [uri "/dump.sql"] [unique_id "atQD93k4XdPOUqU9datzlQAAAYE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:01:38
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:01:35.079605 2026] [security2:error] [pid 10854:tid 10854] [client 172.71.144.65:11562] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lusineweb.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lusineweb.com"] [uri "/db.sql"] [unique_id "atP-T8k1R64N7rgelPcQgQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 20:59:05
(3 days ago)
[17/Oct/2026:23:59:05 +0300] -- 172.71.144.65 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[17/Oct/2026:23:59:05 +0300] -- 172.71.144.65 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /rezerv.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 19:57:27
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 15:57:23.965900 2026] [security2:error] [pid 13440:tid 13440] [client 172.71.144.65:13037] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wendykim.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wendykim.com"] [uri "/rezerv.sql"] [unique_id "atPTI7o_LwWsPSGTEwZ_6gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-17 00:40:05
(4 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
sternwart
2026-10-16 20:22:27
(4 days ago)
Automatisch erkannt: Zugriff auf /.git/config (ict-fachassessment.ch)
Web App Attack
Bad Web Bot
🇩🇪
FeG Deutschland
2026-10-16 12:21:58
(5 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 20:30:20
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 16:30:15.902882 2026] [security2:error] [pid 7262:tid 7262] [client 172.71.144.65:12134] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||vekk.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vekk.org"] [uri "/config.php.bak"] [unique_id "as_mVz4T5EZHPw3xPr6MTgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-14 09:43:20
(1 week ago)
Multiple WAF Violations
Web App Attack
