2026-11-14 09:31:11
UTC ·
(21 hours ago)
Web Probe / Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 14:04:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:04:14.794498 2026] [security2:error] [pid 5531:tid 5531] [client 172.71.164.42:10877] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 09:04:14.794498 2026] [security2:error] [pid 5531:tid 5531] [client 172.71.164.42:10877] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||breinesberger.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "breinesberger.com"] [uri "/index.php.bak"] [unique_id "avcY3tRzbnOeK9LLs0KMSQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
KIDOS
2026-11-10 09:15:59
UTC ·
(4 days ago)
IIS malicious activity: high_400_error_rate (100% of requests are 400 errors)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:32:31
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:32:26.790757 2026] [security2:error] [pid 2506:tid 2506] [client 172.71.164.42:14204] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:32:26.790757 2026] [security2:error] [pid 2506:tid 2506] [client 172.71.164.42:14204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "extreme-atv.com"] [uri "/wp-config.php.bak"] [unique_id "avK6ekIkMTaPj7dSluIIAgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇼
kk_it_man
2026-11-10 03:53:02
UTC ·
(5 days ago)
ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability
Port Scan
🇩🇪
pltcldvlpr
2026-11-10 03:50:13
UTC ·
(5 days ago)
CMS/framework probe: 172.71.164.42 - - [10/Nov/2026:04:50:12 +0100] "GET /credentials.json HTTP/2.0" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" asn=13335 org="Cloudfla ...
show more
CMS/framework probe: 172.71.164.42 - - [10/Nov/2026:04:50:12 +0100] "GET /credentials.json HTTP/2.0" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" asn=13335 org="Cloudflare, Inc." country=DE
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:26:09
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:26:01.817028 2026] [security2:error] [pid 12723:tid 12784] [client 172.71.164.42:10182] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:26:01.817028 2026] [security2:error] [pid 12723:tid 12784] [client 172.71.164.42:10182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.arizonasolutionsgroup.com"] [uri "/wp-config.php.bak"] [unique_id "avJkmYVVw3KsJFhPs9tJSwAAAQU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-07 19:19:19
UTC ·
(1 week ago)
{"level":"info","ts":1794079158.736689,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.71.164.42","remote_port":"11518","client_ip":"172.71.164.42","proto":"HTTP/1.1","method":"GET","host":"up.visrey.me","uri":"/me ...
show more
{"level":"info","ts":1794079158.736689,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.71.164.42","remote_port":"11518","client_ip":"172.71.164.42","proto":"HTTP/1.1","method":"GET","host":"up.visrey.me","uri":"/media/system/js/core.js","headers":{"Cdn-Loop":["cloudflare; loops=1"],"Cf-Visitor":["{\"scheme\":\"http\"}"],"X-Forwarded-For":["168.107.78.68"],"Accept-Encoding":["gzip"],"User-Agent":["Go-http-client/1.1"],"Cf-Connecting-Ip":["168.107.78.68"],"Cf-Ray":["a56eb0557ad8ce4e-FRA"],"Cf-Ipcountry":["SG"],"Connection":["Keep-Alive"],"X-Forwarded-Proto":["http"]}},"bytes_read":0,"user_id":"","duration":0.000089681,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://up.visrey.me/media/system/js/core.js"],"Content-Type":[]}}
...
show less
DDoS Attack
Web App Attack
🇩🇪
altenglaner
2026-11-07 02:51:53
UTC ·
(1 week ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 08:33:59
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:33:54.495302 2026] [security2:error] [pid 11835:tid 11835] [client 172.71.164.42:10490] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 03:33:54.495302 2026] [security2:error] [pid 11835:tid 11835] [client 172.71.164.42:10490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oliverhardy.com"] [uri "/.env.staging"] [unique_id "auw_cvTaLYvtifzNsK2qSAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 01:12:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 20:12:43.053792 2026] [security2:error] [pid 3981363:tid 3981394] [client 172.71.164.42:1187 ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 20:12:43.053792 2026] [security2:error] [pid 3981363:tid 3981394] [client 172.71.164.42:11871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.e819.kylight.com"] [uri "/wp-config.php"] [unique_id "auqGi47_jmQ65HNmHRlc9gAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 19:52:40
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 14:52:33.449556 2026] [security2:error] [pid 18871:tid 18871] [client 172.71.164.42:11443] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 14:52:33.449556 2026] [security2:error] [pid 18871:tid 18871] [client 172.71.164.42:11443] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.brodyworks.com"] [uri "/.git/config"] [unique_id "aujqASXFyPpb_34oSBVbwAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-02 17:23:41
UTC ·
(1 week ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 04:07:42
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:07:33.929754 2026] [security2:error] [pid 16508:tid 16508] [client 172.71.164.42:13890] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:07:33.929754 2026] [security2:error] [pid 16508:tid 16508] [client 172.71.164.42:13890] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.partybuswhistler.com"] [uri "/.env.backup"] [unique_id "aua7BQi129BNNO0IyEgy3wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-30 15:48:43
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
