🇮🇹
CoreTech srl
2026-11-07 15:33:56
UTC ·
(18 hours ago)
cloudlinux2 fail2ban: 2026-11-07 16:30:27,355 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 91.193.232.12 - 2026-11-07 16:30:27cloudlinux2 fail2ban: 2026-11-07 16:31:35,860 fail2ban.filter [1651]: INFO [plesk-wordpress] F ...
show more
cloudlinux2 fail2ban: 2026-11-07 16:30:27,355 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 91.193.232.12 - 2026-11-07 16:30:27cloudlinux2 fail2ban: 2026-11-07 16:31:35,860 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 216.24.219.78 - 2026-11-07 16:31:35cloudlinux2 fail2ban: 2026-11-07 16:31:35,857 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 104.234.19.90 - 2026-11-07 16:31:35cloudlinux2 fail2ban: 2026-11-07 16:31:39,913 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.71.148.128 - 2026-11-07 16:31:39cloudlinux2 fail2ban: 2026-11-07 16:31:39,928 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.71.148.41 - 2026-11-07 16:31:39cloudlinux2 fail2ban: 2026-11-07 16:31:41,077 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.71.148.128 - 2026-11-07 16:31:41cloudlinux2 fail2ban: 2026-11-07 16:31:40,357 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.71.148.129 - 2026-11-07 16:31:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 05:44:09
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:44:03.315198 2026] [security2:error] [pid 14079:tid 14079] [client 172.71.148.128:12060] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:44:03.315198 2026] [security2:error] [pid 14079:tid 14079] [client 172.71.148.128:12060] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "leevardaman.com"] [uri "/wp-config.php.bak"] [unique_id "au66o5W7DU7ds950jTy7PQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-06 18:27:07
UTC ·
(1 day ago)
{"level":"info","ts":1793989626.7143056,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.71.148.128","remote_port":"11494","client_ip":"172.71.148.128","proto":"HTTP/1.1","method":"GET","host":"status.igbio.co","uri ...
show more
{"level":"info","ts":1793989626.7143056,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.71.148.128","remote_port":"11494","client_ip":"172.71.148.128","proto":"HTTP/1.1","method":"GET","host":"status.igbio.co","uri":"/next.config.js","headers":{"True-Client-Ip":["100.97.189.192"],"X-Custom-Ip-Authorization":["100.97.189.192"],"Cluster-Client-Ip":["100.97.189.192"],"Cdn-Loop":["cloudflare; loops=1"],"X-Remote-Addr":["100.97.189.192"],"Connection":["Keep-Alive"],"X-Remote-Ip":["100.97.189.192"],"Accept-Encoding":["gzip, br"],"X-Forwarded-For":["100.97.189.192,34.7.53.221"],"X-Nextjs-Data":["1"],"Cf-Connecting-Ip":["34.7.53.221"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Ray":["a566267eaf14f5e3-FRA"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Ap
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 16:24:27
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:24:24.534811 2026] [security2:error] [pid 19775:tid 19775] [client 172.71.148.128:9453] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:24:24.534811 2026] [security2:error] [pid 19775:tid 19775] [client 172.71.148.128:9453] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teapartytaxes.com"] [uri "/.svn/entries"] [unique_id "aui5ONDLPASyjDieGI_EyAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-02 08:07:02
UTC ·
(6 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
altenglaner
2026-11-01 08:20:20
UTC ·
(1 week ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇫🇷
dynamix
2026-10-27 07:04:38
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
francelink.fr
2026-10-25 19:00:31
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-25T07:46:48.000Z.
Web App Attack
🇫🇷
dynamix
2026-10-25 02:21:19
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇩🇪
altenglaner
2026-10-23 02:48:48
UTC ·
(2 weeks ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇫🇷
dynamix
2026-10-20 20:14:05
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇸🇬
anotherwatcher
2026-10-18 14:00:43
UTC ·
(2 weeks ago)
bad bot
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-18 03:42:32
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:42:25.712203 2026] [security2:error] [pid 16631:tid 16693] [client 172.71.148.128:10837] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:42:25.712203 2026] [security2:error] [pid 16631:tid 16693] [client 172.71.148.128:10837] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thebiglies.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thebiglies.com"] [uri "/admin/config.php.bak"] [unique_id "atRAITc98tp62h3LHZcA4wAAARg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:59:32
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:59:13.370544 2026] [security2:error] [pid 16632:tid 16632] [client 172.71.148.128:12425] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:59:13.370544 2026] [security2:error] [pid 16632:tid 16632] [client 172.71.148.128:12425] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||inversionestalarame.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "inversionestalarame.com"] [uri "/inversionestalarame.sql"] [unique_id "atQZ4Y1zvGLl_dzbb62-YAAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:02:47
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:02:39.670884 2026] [security2:error] [pid 20783:tid 20783] [client 172.71.148.128:9501] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:02:39.670884 2026] [security2:error] [pid 20783:tid 20783] [client 172.71.148.128:9501] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.dunbartonucc.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.dunbartonucc.org"] [uri "/db.sql"] [unique_id "atPwf4YOvGBP27Nt9mSpHQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
