🇺🇸
TPI-Abuse
2026-10-18 14:33:39
(10 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:33:33.293057 2026] [security2:error] [pid 9909:tid 9909] [client 172.71.148.121:11386] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||scswat.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "scswat.org"] [uri "/backup.sql"] [unique_id "atTYvaLU2irQRp_r3hAo-AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:00:39
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:00:35.385825 2026] [security2:error] [pid 21834:tid 21834] [client 172.71.148.121:14203] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jpwatters.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jpwatters.net"] [uri "/backup.sql"] [unique_id "atTRAxI1sHY6jMEIGjqVlAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:21:29
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:21:23.476026 2026] [security2:error] [pid 8608:tid 8758] [client 172.71.148.121:9574] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||southtampaprints.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "southtampaprints.com"] [uri "/db.sql"] [unique_id "atTH01FLS7H2mPib5mZKRQAAANU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:13:04
(12 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:12:56.141037 2026] [security2:error] [pid 11642:tid 11656] [client 172.71.148.121:12971] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||malvadocuaderno.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "malvadocuaderno.com"] [uri "/malvadocuaderno.com.sql"] [unique_id "atS3yJq8ppphJymAHkt0rgAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Smish
2026-10-18 03:37:58
(21 hours ago)
HONEYPOT HIT --> Fail2ban time=1792294676 log=2026-10-18T04:37:56+01:00 ip=172.71.148.121 host=dal-u ...
show more
HONEYPOT HIT --> Fail2ban time=1792294676 log=2026-10-18T04:37:56+01:00 ip=172.71.148.121 host=dal-ultplus-01.bya.ac method=GET uri="/bya.sql" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" ref="-" rid=8ab8af6f51c4f749780c83bde3d92a2f
show less
Web App Attack
🇩🇪
FD-IX
2026-10-18 02:51:34
(22 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-18 02:17:55
(22 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
fineservice
2026-10-18 01:06:16
(1 day ago)
PrestaShop Security Module: WordPress probe path detected
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 23:16:15
(1 day ago)
[18/Oct/2026:02:16:14 +0300] -- 172.71.148.121 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:02:16:14 +0300] -- 172.71.148.121 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /backup.sql HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:47:44
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:47:39.264500 2026] [security2:error] [pid 6103:tid 6103] [client 172.71.148.121:13941] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dipseanet.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dipseanet.com"] [uri "/dump.sql"] [unique_id "atP7C-OV1XqOsoRd5WDFmwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:17:48
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:17:39.994510 2026] [security2:error] [pid 12162:tid 12162] [client 172.71.148.121:13217] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||marketask.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "marketask.com"] [uri "/dump.sql"] [unique_id "atPl87rKaLqzTDA2MpzqbgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 06:59:32
(4 days ago)
[14/Oct/2026:09:59:31 +0300] -- 172.71.148.121 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[14/Oct/2026:09:59:31 +0300] -- 172.71.148.121 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /www.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:38:24
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:38:19.001938 2026] [security2:error] [pid 4968:tid 4968] [client 172.71.148.121:11251] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bacpool.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bacpool.com"] [uri "/rezerv.sql"] [unique_id "as8VSm-sXoCkyxDgagfWhgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-14 01:21:22
(4 days ago)
[WedOct1403:21:18.2268732026][security2:error][pid1817618:tid1817708][client172.71.148.121:0]ModSecu ...
show more
[WedOct1403:21:18.2268732026][security2:error][pid1817618:tid1817708][client172.71.148.121:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"globalhorizon.ch\"][uri\"/globalhorizon.sql\"][unique_id\"as7ZDizYJPFjsMD1Vgl0zAAAAQc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:58:54
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:58:49.440125 2026] [security2:error] [pid 15503:tid 15503] [client 172.71.148.121:10795] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title34.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title34.com"] [uri "/admin/config.php.bak"] [unique_id "as7FubOvGjnnMLWv-Mv_BwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
