🇫🇷
dynamix
2026-10-15 20:19:31
(9 minutes ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 04:41:10
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 00:41:06.421234 2026] [security2:error] [pid 15395:tid 15413] [client 172.71.164.165:11234] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.a2zlns.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.a2zlns.com"] [uri "/db.sql"] [unique_id "atBZYr6RQOVQ1G1OFkebrwAAAJA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Prcek
2026-10-14 20:56:11
(23 hours ago)
PortScan:HOST=172.71.164.165,DPORTS=443
Port Scan
🇫🇷
dynamix
2026-10-14 13:23:54
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 07:07:08
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:07:01.361588 2026] [security2:error] [pid 2993:tid 2993] [client 172.71.164.165:13030] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.shannonraevocalstudio.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.shannonraevocalstudio.com"] [uri "/shannonraevocalstudio.com.sql"] [unique_id "as8qFXw3wIa8OUkk8yT3_QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 06:46:09
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 02:46:03.840448 2026] [security2:error] [pid 15003:tid 15003] [client 172.71.164.165:13616] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bowdens-landing.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bowdens-landing.com"] [uri "/config.php.bak"] [unique_id "as8lK61ic8yFd5DBgT7iMAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:51:51
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:51:41.689598 2026] [security2:error] [pid 18907:tid 18907] [client 172.71.164.165:10308] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||saboun.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "saboun.com"] [uri "/database.sql"] [unique_id "as8YbVvmnC11nXMvRP2d_gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:19:11
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:19:04.930507 2026] [security2:error] [pid 21450:tid 21450] [client 172.71.164.165:10387] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thingstodonude.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thingstodonude.com"] [uri "/database.sql"] [unique_id "as70qERbA9MTsg65akME6QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:23:10
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:23:03.781765 2026] [security2:error] [pid 27355:tid 27355] [client 172.71.164.165:13569] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dragonflytunes.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dragonflytunes.com"] [uri "/db.sql"] [unique_id "as7LZwrkCtZaXIYMwVPnZQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:51:12
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:51:06.010246 2026] [security2:error] [pid 7745:tid 7745] [client 172.71.164.165:12690] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nautanet.info|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nautanet.info"] [uri "/config.php.bak"] [unique_id "as612oaQ883jT_p8dgTR5AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-30 11:57:12
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-03 06:41:40
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-16 01:35:49
(1 month ago)
Web App Attack
🇩🇪
acadeova
2026-08-07 19:19:27
(2 months ago)
🚨 Recon detected (nft drop)
SRC=172.71.164.165
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(jour ...
show more
🚨 Recon detected (nft drop)
SRC=172.71.164.165
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇧🇪
madeit
2026-08-06 06:00:50
(2 months ago)
Web App Attack
