🇨🇭
TheCoon
2026-10-21 06:46:28
(22 hours ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
2026-10-21 03:42:09
(1 day ago)
Web Probe / Attack
Web App Attack
🇨🇦
webemsegundos
2026-10-20 12:34:12
(1 day ago)
Web vulnerability scanner: 1 probe paths (e.g. /wp-admin/install.php). Blocked by WeS Firewall.
Bad Web Bot
Web App Attack
🇨🇦
webemsegundos
2026-10-19 10:47:02
(2 days ago)
Web vulnerability scanner: 1 probe paths (e.g. /wp-admin/install.php). Blocked by WeS Firewall.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:46:22
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:46:15.505583 2026] [security2:error] [pid 24088:tid 24088] [client 172.71.148.178:13745] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rockhillcounselors.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rockhillcounselors.com"] [uri "/admin/config.php.bak"] [unique_id "atSxh45-O5ag-HT5kmEMmwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 01:30:23
(4 days ago)
[18/Oct/2026:04:30:22 +0300] -- 172.71.148.178 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:04:30:22 +0300] -- 172.71.148.178 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /backup.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:29:12
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:29:09.113682 2026] [security2:error] [pid 9158:tid 9158] [client 172.71.148.178:13372] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||eagleoaks.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eagleoaks.net"] [uri "/rezerv.sql"] [unique_id "atQS1V7OHYDApLGFkpXSkwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:49:32
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:49:25.596205 2026] [security2:error] [pid 29998:tid 29998] [client 172.71.148.178:11326] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.daviddholt.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.daviddholt.com"] [uri "/rezerv.sql"] [unique_id "atP7dRaDwmvszSv2C3dIBQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-16 02:19:32
(6 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 16:29:24
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:29:18.231809 2026] [security2:error] [pid 25767:tid 25767] [client 172.71.148.178:12524] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.personalizedbirthdaynapkins.com"] [uri "/.git/config"] [unique_id "as-t3jYp5r4znJywjVVgjAAAAHI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Yosi
2026-10-14 12:01:42
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇺🇸
TPI-Abuse
2026-10-13 23:11:00
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:10:50.795637 2026] [security2:error] [pid 10244:tid 10244] [client 172.71.148.178:9821] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||art.mavikalem.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "art.mavikalem.org"] [uri "/admin/config.php.bak"] [unique_id "as66etJ35U9ipkRr_d7M8QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:22:58
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:22:49.810020 2026] [security2:error] [pid 15137:tid 15137] [client 172.71.148.178:9421] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||joshseipel.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "joshseipel.com"] [uri "/db.sql"] [unique_id "as6vOXrFImd3gEJxHlVQvQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Yosi
2026-10-11 22:01:44
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇬🇧
Yosi
2026-10-09 20:54:46
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
