🇺🇸
TPI-Abuse
2026-10-18 14:21:16
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:21:09.777773 2026] [security2:error] [pid 13427:tid 13448] [client 172.71.164.153:13872] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.biblewriter.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.biblewriter.com"] [uri "/dump.sql"] [unique_id "atTV1f77QDPiy6j4rlwnPQAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:56:36
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:56:30.674026 2026] [security2:error] [pid 2537:tid 2537] [client 172.71.164.153:12548] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||purplebikinis.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "purplebikinis.com"] [uri "/db.sql"] [unique_id "atSz7hCCi9u8KMbBuoEUFwAAAHk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 05:15:31
(1 day ago)
[18/Oct/2026:08:15:30 +0300] -- 172.71.164.153 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:08:15:30 +0300] -- 172.71.164.153 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /config.php.bak HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:23:42
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:23:33.863631 2026] [security2:error] [pid 26622:tid 26622] [client 172.71.164.153:10814] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||z-industrial.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "z-industrial.com"] [uri "/config.php.bak"] [unique_id "atQ7tWKRpILTjaG5SXy5NwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:22:41
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:22:36.187876 2026] [security2:error] [pid 27022:tid 27022] [client 172.71.164.153:12493] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dalessalesandservice.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dalessalesandservice.com"] [uri "/db.sql"] [unique_id "atQtbK-_jsrXeji3BtsMMgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:24:50
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:24:42.324011 2026] [security2:error] [pid 18246:tid 18246] [client 172.71.164.153:12335] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||fromthehandofgodministry.org|F|2"] [data ".org.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fromthehandofgodministry.org"] [uri "/fromthehandofgodministry.org.sql"] [unique_id "atQf2jteQ9IOmi7pakJtnAAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:43:32
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:43:26.842280 2026] [security2:error] [pid 20676:tid 20676] [client 172.71.164.153:11665] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.amgtr.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.amgtr.com"] [uri "/db.sql"] [unique_id "as76XrOzf-IGysa0BtR54wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:02:35
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.153 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:02:28.588205 2026] [security2:error] [pid 28239:tid 28239] [client 172.71.164.153:10190] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||erinrusso.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "erinrusso.com"] [uri "/rezerv.sql"] [unique_id "as64hPi7JmVD65sou49ZrQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-07 04:18:30
(1 week ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-01 12:32:45
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-03 06:42:50
(1 month ago)
Web App Attack
🇺🇸
mawan
2026-08-20 15:32:08
(1 month ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇧🇪
madeit
2026-08-07 23:37:48
(2 months ago)
Web App Attack
🇩🇪
webanyone
2026-08-07 03:01:13
(2 months ago)
Apache web server attack detected by Fail2Ban in plesk-apache jail
Web App Attack
🇷🇺
DZBOT
2026-08-06 02:02:51
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
