๐ซ๐ท
dynamix
2026-10-22 02:43:43
(8 hours ago)
Multiple WAF Violations
Web App Attack
๐บ๐ธ
JGouin
2026-10-18 20:27:45
(3 days ago)
172.71.172.17 [18/Oct/2026:16:27:45 -0400] "GET /wp-content/plugins/bricksforge/readme.txt HTTP/2.0" ...
show more
172.71.172.17 [18/Oct/2026:16:27:45 -0400] "GET /wp-content/plugins/bricksforge/readme.txt HTTP/2.0" 200 tarpit_triggered
...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-18 02:52:14
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:52:08.319813 2026] [security2:error] [pid 28355:tid 28355] [client 172.71.172.17:12735] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||ruizpuche.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ruizpuche.com"] [uri "/config.php.bak"] [unique_id "atQ0WAVBIMniNJoNY0FO-QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-17 20:42:33
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:42:27.239963 2026] [security2:error] [pid 12009:tid 12009] [client 172.71.172.17:12186] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||zaril.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "zaril.com"] [uri "/zaril.sql"] [unique_id "atPdsztZIjTj5TA17PzVgQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
dynamix
2026-10-15 13:37:36
(6 days ago)
Multiple WAF Violations
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-14 05:39:55
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:39:49.999510 2026] [security2:error] [pid 30179:tid 30179] [client 172.71.172.17:13276] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||waltersnet.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "waltersnet.com"] [uri "/db.sql"] [unique_id "as8VpaKEoM7yeLOUfsJiDgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-14 03:58:04
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:57:57.237569 2026] [security2:error] [pid 25517:tid 25541] [client 172.71.172.17:13065] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||absurdotron.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "absurdotron.com"] [uri "/absurdotron.sql"] [unique_id "as79xeL7vEQgFv0CIb2NuQAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-14 00:15:38
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:15:33.222806 2026] [security2:error] [pid 12135:tid 12135] [client 172.71.172.17:9261] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ssion.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ssion.com"] [uri "/rezerv.sql"] [unique_id "as7JpfGMRxTtSLrDA30h5QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-13 22:32:57
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.172.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:32:52.880449 2026] [security2:error] [pid 12401:tid 12401] [client 172.71.172.17:9517] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||reelfruits.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "reelfruits.com"] [uri "/reelfruits.sql"] [unique_id "as6xlITKAYQ4Gd1DOf-4pAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
LMAS
2026-10-13 22:27:25
(1 week ago)
HTTP honeypot request observed. Inferred classification: Unclassified/Wildcard Probe. Path: /public_ ...
show more
HTTP honeypot request observed. Inferred classification: Unclassified/Wildcard Probe. Path: /public_html.zip
show less
Brute-Force
Web App Attack
๐ฏ๐ต
S.O.B.A. Dev.
2026-10-07 01:59:42
(2 weeks ago)
Persistent port scanning or vulnerability scanning
Port Scan
๐ซ๐ท
dynamix
2026-10-01 22:30:35
(2 weeks ago)
Multiple WAF Violations
Web App Attack
๐ง๐ช
madeit
2026-09-29 14:02:41
(3 weeks ago)
Web App Attack
๐ฉ๐ช
updown.io
2026-09-26 02:39:49
(3 weeks ago)
{"level":"info","ts":1790390389.2669349,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1790390389.2669349,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.71.172.17","remote_port":"13745","client_ip":"127.0.0.1","proto":"HTTP/2.0","method":"GET","host":"status.acmutsa.org","uri":"/database%2emysql%2egz","headers":{"X-Host":["127.0.0.1"],"Accept":["*/*"],"X-Forwared":["127.0.0.1"],"X-Azure-Clientip":["127.0.0.1"],"Accept-Encoding":["gzip, br"],"Cf-Ipcountry":["FR"],"Cf-Connecting-Ip":["185.177.72.56"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Ray":["a40ee67cb9ce565a-FRA"],"Cdn-Loop":["cloudflare; loops=1"],"X-Forwarded-For":["127.0.0.1,185.177.72.56"],"X-Client-Ip":["127.0.0.1"],"X-Azure-Socketip":["127.0.0.1"],"User-Agent":["curl/8.7.1"],"X-Originating-Ip":["127.0.0.1"],"X-Forwarded-Proto":["https"],"True-Client-Ip":["127.0.0.1"],"Accept-Language":["en-US,en;q=0.9"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.acmutsa.org","ech":false}},"bytes_read":0,"user_id":"","d
...
show less
DDoS Attack
Web App Attack
๐ง๐ช
madeit
2026-09-02 02:06:35
(1 month ago)
Web App Attack