🇫🇷
dynamix
2026-11-13 02:42:18
UTC ·
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 00:59:36
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:59:30.082355 2026] [security2:error] [pid 32143:tid 32143] [client 172.71.164.63:11307] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:59:30.082355 2026] [security2:error] [pid 32143:tid 32143] [client 172.71.164.63:11307] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bringkittyhome.com"] [uri "/wp-config.php.save"] [unique_id "avO98veK60SBdZ-ibXjBoAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:26:20
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:13.689505 2026] [security2:error] [pid 5174:tid 5250] [client 172.71.164.63:11194] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:13.689505 2026] [security2:error] [pid 5174:tid 5250] [client 172.71.164.63:11194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "property-management-companies-chicago.com"] [uri "/wp-config.php.save"] [unique_id "avLVJVI_yFApnINUZFXFPwAAAYs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Rexyraz
2026-11-09 23:39:15
UTC ·
(4 days ago)
172.71.164.63 - - [09/Nov/2026:23:39:15 +0000] "POST /wp-login.php HTTP/1.1" 404 643 "https://opticad3.com/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0"
...
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-11-09 13:24:31
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:24:26.056110 2026] [security2:error] [pid 8416:tid 8416] [client 172.71.164.63:11893] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:24:26.056110 2026] [security2:error] [pid 8416:tid 8416] [client 172.71.164.63:11893] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||emhelectric.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "emhelectric.com"] [uri "/index.php.bak"] [unique_id "avHJio8hcUkh-jkSWJ_lsgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 03:48:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:48:13.291478 2026] [security2:error] [pid 14561:tid 14561] [client 172.71.164.63:10066] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:48:13.291478 2026] [security2:error] [pid 14561:tid 14561] [client 172.71.164.63:10066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.amazinghydraulics.com"] [uri "/.git/config"] [unique_id "au6ffcfT3CVNHIW_0GlDuQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-11-05 06:15:34
UTC ·
(1 week ago)
9 attacks on password/key grabbing URLs:
GET /.ssh/id_rsa HTTP/1.1
Hacking
🇺🇸
TPI-Abuse
2026-11-02 05:34:09
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:34:02.811433 2026] [security2:error] [pid 22127:tid 22127] [client 172.71.164.63:13067] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:34:02.811433 2026] [security2:error] [pid 22127:tid 22127] [client 172.71.164.63:13067] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.crescentcitycafe.org"] [uri "/.env.dev"] [unique_id "auggyuv2JrcragERjEAxOQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 18:44:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:44:35.774798 2026] [security2:error] [pid 15208:tid 15225] [client 172.71.164.63:11180] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.71.164.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:44:35.774798 2026] [security2:error] [pid 15208:tid 15225] [client 172.71.164.63:11180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.mailme.name"] [uri "/.env"] [unique_id "aueIkyi2wpHcY4HfeEXF9wAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ipoac.nl
2026-11-01 12:25:38
UTC ·
(1 week ago)
ipoac.nl:80 172.71.164.63 - - [01/Nov/2026:13:25:38 +0100] - "GET /wp-admin/install.php?step=1 HTTP/1.1" 403 1709 "-" "http://-/wp-admin/install.php?step=1"
Bad Web Bot
🇩🇪
altenglaner
2026-11-01 06:13:57
UTC ·
(1 week ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇫🇷
dynamix
2026-10-26 10:11:47
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-25 04:59:33
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
2026-10-25 03:19:06
UTC ·
(2 weeks ago)
IP matched detection query many 3xx errors.
Brute-Force
🇩🇪
altenglaner
2026-10-23 19:46:06
UTC ·
(3 weeks ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
