🇫🇷
dynamix
2026-10-26 06:09:27
(15 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-24 13:43:22
(2 days ago)
Multiple WAF Violations
Web App Attack
🇳🇱
i-turnradio.nl
2026-10-23 15:19:41
(3 days ago)
2026-10-23 @ 17:19:41 (CET) ~ Blocked for trying to access: /admin.php
Web App Attack
🇫🇮
Erpelstolz
2026-10-22 23:04:16
(3 days ago)
external host: 172.71.164.127 - - [23/Oct/2026:01:04:15 +0200] "GET /wp-admin/install.php?step=1 HTT ...
show more
external host: 172.71.164.127 - - [23/Oct/2026:01:04:15 +0200] "GET /wp-admin/install.php?step=1 HTTP/1.1" 301 325 "-" "http://erpelstolz.com/wp-admin/install.php?step=1" CF-Ray:a4ec23d5cb47d271-FRA CF-IP:-
show less
Web App Attack
🇩🇪
altenglaner
2026-10-22 20:05:58
(4 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:56:43
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:56:38.865018 2026] [security2:error] [pid 26152:tid 26152] [client 172.71.164.127:10109] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wealthsec.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wealthsec.com"] [uri "/admin/config.php.bak"] [unique_id "atTeJoXcOMaJTPAp8ePBAgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-18 11:47:08
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 10:03:53
(1 week ago)
[18/Oct/2026:13:03:52 +0300] -- 172.71.164.127 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:13:03:52 +0300] -- 172.71.164.127 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /edu.sql HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:03:33
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:03:24.505620 2026] [security2:error] [pid 13044:tid 13044] [client 172.71.164.127:13071] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||smart1services.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "smart1services.com"] [uri "/rezerv.sql"] [unique_id "atRhLBUcjbo-XlVbKKlVFgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:01:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:01:10.025347 2026] [security2:error] [pid 17647:tid 17647] [client 172.71.164.127:11450] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ageh.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ageh.com"] [uri "/config.php.bak"] [unique_id "atQoZm8-L_I1kED9DPD7iAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:48:08
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:48:00.924433 2026] [security2:error] [pid 24959:tid 24959] [client 172.71.164.127:9391] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||intothebigempty.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "intothebigempty.com"] [uri "/dump.sql"] [unique_id "atP7IJru2aN0loQzQkBAfwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:33:40
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:33:35.485037 2026] [security2:error] [pid 12551:tid 12551] [client 172.71.164.127:11795] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||minietonrailroad.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "minietonrailroad.org"] [uri "/database.sql"] [unique_id "atPpr1ELBStEHV4FoY1sMAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:59:15
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:59:07.762280 2026] [security2:error] [pid 8551:tid 8551] [client 172.71.164.127:13860] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dandemonium.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dandemonium.net"] [uri "/rezerv.sql"] [unique_id "atPhm8xxbUJ2f9_j4_VGuAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
gbutiri
2026-10-17 20:53:12
(1 week ago)
Automated report: source IP probed nonexistent .php paths on our web server (vulnerability scanning ...
show more
Automated report: source IP probed nonexistent .php paths on our web server (vulnerability scanning / bad bot).
show less
Web App Attack
Bad Web Bot
🇫🇷
dynamix
2026-10-16 06:28:50
(1 week ago)
Multiple WAF Violations
Web App Attack
