2026-10-18 17:02:22
(22 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:59:32
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:59:27.395683 2026] [security2:error] [pid 778:tid 778] [client 172.71.148.24:12173] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||skotam.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "skotam.com"] [uri "/skotam.sql"] [unique_id "atTez77AemjvLfYT3UIn-wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:27:15
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:27:10.349664 2026] [security2:error] [pid 12653:tid 12653] [client 172.71.148.24:12056] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.davidquiroa.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.davidquiroa.com"] [uri "/admin/config.php.bak"] [unique_id "atS7HkIOagG96rhqO_45hQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:29:53
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:29:48.396223 2026] [security2:error] [pid 28969:tid 28969] [client 172.71.148.24:10433] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kadinisi.org|F|2"] [data ".org.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kadinisi.org"] [uri "/kadinisi.org.sql"] [unique_id "atStrEx8_bO4GnJgvdrWUwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:34:28
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:34:21.384006 2026] [security2:error] [pid 17941:tid 17959] [client 172.71.148.24:9332] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.outsidermedia.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.outsidermedia.com"] [uri "/db.sql"] [unique_id "atSEjejQszweK7GwR_A-RQAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:58:39
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:58:34.473044 2026] [security2:error] [pid 30862:tid 30862] [client 172.71.148.24:13603] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||claireashtoncounseling.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "claireashtoncounseling.com"] [uri "/claireashtoncounseling.com.sql"] [unique_id "atR8KuxVqIbXWwq2uZqhtQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:23:06
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:22:59.048749 2026] [security2:error] [pid 22832:tid 22854] [client 172.71.148.24:12869] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||360degreevalue.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "360degreevalue.com"] [uri "/360degreevalue.sql"] [unique_id "atRlw7UZkbvnX-NM3QO_3AAAAJQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 05:24:33
(1 day ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-18 05:16:20
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:16:12.874031 2026] [security2:error] [pid 25633:tid 25633] [client 172.71.148.24:10188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||artspacecleveland.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artspacecleveland.org"] [uri "/db.sql"] [unique_id "atRWHHI80U7KHkVNBFg8ewAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:01:07
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:00:59.764900 2026] [security2:error] [pid 18886:tid 18886] [client 172.71.148.24:9760] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||peggyannjones.us|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "peggyannjones.us"] [uri "/database.sql"] [unique_id "atRSizN1P0gxCkkHnWzl7QAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:38:14
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:38:10.162909 2026] [security2:error] [pid 13806:tid 13806] [client 172.71.148.24:10845] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vgalleria.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vgalleria.com"] [uri "/dump.sql"] [unique_id "atRNMuE56xWc96Cas1YsJQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
SchiWaGoA
2026-10-18 03:39:39
(1 day ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
🇺🇸
nationaleventpros.com
2026-10-18 03:15:40
(1 day ago)
vulnerability scan
Web App Attack
🇫🇷
PhiJai
2026-10-18 01:00:01
(1 day ago)
Signalement automatique (DEUS NemesisBanisher). fouille : a récupéré un fichier de secrets (/admin/c ...
show more
Signalement automatique (DEUS NemesisBanisher). fouille : a récupéré un fichier de secrets (/admin/config.php.bak).
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 21:24:35
(1 day ago)
[18/Oct/2026:00:24:33 +0300] -- 172.71.148.24 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:00:24:33 +0300] -- 172.71.148.24 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /site.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
