🇲🇽
octageeks.com
2026-10-25 04:21:16
(5 hours ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇫🇷
dynamix
2026-10-24 22:49:21
(10 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-22 16:13:48
(2 days ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-21 11:09:25
(3 days ago)
Web App Attack
🇨🇭
backslash
2026-10-19 18:06:00
(5 days ago)
block ruleset bad bot: misc bad content F608233CC4C86EE814CE8DDDA9C4A0D3C79882F6
Bad Web Bot
🇩🇪
baphomet
2026-10-19 14:28:02
(5 days ago)
Probed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.e ...
show more
Probed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.env/wp-login/xmlrpc/phpmyadmin/.git).
jail=nginx-canary proto=tcp port=80,443 failures>=2 class=web-app-probe
these paths are not real apps on this host; hit is hostile recon
when=2026-10-19T14:28:02Z sensor=fail2ban role=web-canary
src=172.71.164.144
show less
Web App Attack
🇫🇷
dynamix
2026-10-19 03:26:44
(6 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:47:13
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:47:08.859148 2026] [security2:error] [pid 10115:tid 10115] [client 172.71.164.144:9435] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||islandsuperbook.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "islandsuperbook.net"] [uri "/backup.sql"] [unique_id "atTN3GMnnEEUWQqaTyikHgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:04:06
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:03:58.409858 2026] [security2:error] [pid 5768:tid 5768] [client 172.71.164.144:9692] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dougscomputers.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dougscomputers.com"] [uri "/rezerv.sql"] [unique_id "atTDvo8WnetOQ7LzVlOlUAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 08:06:57
(1 week ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-18 08:00:54
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:00:46.850848 2026] [security2:error] [pid 9952:tid 9952] [client 172.71.164.144:13954] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||leobynum.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "leobynum.com"] [uri "/leobynum.com.sql"] [unique_id "atR8rtCpF1C7r5P8f9YGGwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:09:48
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:09:38.403624 2026] [security2:error] [pid 1216:tid 1216] [client 172.71.164.144:10697] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||tankservicesinc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tankservicesinc.com"] [uri "/rezerv.sql"] [unique_id "atRiolWXDyPHVqBTj_d0LwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:42:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:42:33.261027 2026] [security2:error] [pid 27705:tid 27705] [client 172.71.164.144:13669] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||texaslawman.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "texaslawman.net"] [uri "/backup.sql"] [unique_id "atROOUIPMw8hAc_qZvAr6AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 23:19:11
(1 week ago)
[18/Oct/2026:02:19:09 +0300] -- 172.71.164.144 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:02:19:09 +0300] -- 172.71.164.144 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /site.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:51:20
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:51:16.390073 2026] [security2:error] [pid 10477:tid 10477] [client 172.71.164.144:11374] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.eta-mct.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.eta-mct.com"] [uri "/eta-mct.sql"] [unique_id "atP75MFZP0_h_g1sr1NggQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
