🇫🇷
dynamix
2026-10-25 06:56:01
(3 days ago)
Multiple WAF Violations
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-10-24 20:46:57
(4 days ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇩🇪
stinpriza
2026-10-24 19:41:03
(4 days ago)
Web App Attack
Web App Attack
🇧🇪
madeit
2026-10-21 07:19:41
(1 week ago)
Web App Attack
🇩🇪
4server
2026-10-18 13:25:37
(1 week ago)
[SunOct1815:25:33.0223942026][security2:error][pid3981383:tid3981479][client172.71.247.94:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacc ...
show more
[SunOct1815:25:33.0223942026][security2:error][pid3981383:tid3981479][client172.71.247.94:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.royalhosting.ch\"][uri\"/royalhosting.sql\"][unique_id\"atTIzVOIa3GddB1B_nF_YAAAAQo\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:07:40
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:07:36.887548 2026] [security2:error] [pid 20671:tid 20671] [client 172.71.247.94:13436] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:07:36.887548 2026] [security2:error] [pid 20671:tid 20671] [client 172.71.247.94:13436] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mikedeutsch.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mikedeutsch.com"] [uri "/db.sql"] [unique_id "atTEmC2bt_aBcGUqvPP2EgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:34:36
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:34:30.417550 2026] [security2:error] [pid 2689:tid 2689] [client 172.71.247.94:10291] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:34:30.417550 2026] [security2:error] [pid 2689:tid 2689] [client 172.71.247.94:10291] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.alccontractorsllc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.alccontractorsllc.com"] [uri "/database.sql"] [unique_id "atSgtl5OiUuRNbirOWb2XAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:22:50
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:22:44.732238 2026] [security2:error] [pid 7842:tid 7842] [client 172.71.247.94:11033] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:22:44.732238 2026] [security2:error] [pid 7842:tid 7842] [client 172.71.247.94:11033] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tataylor.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tataylor.net"] [uri "/admin/config.php.bak"] [unique_id "atRJlCLex2J_5NutR8oj8QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:51:01
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:50:53.108003 2026] [security2:error] [pid 20165:tid 20296] [client 172.71.247.94:9289] Mo ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:50:53.108003 2026] [security2:error] [pid 20165:tid 20296] [client 172.71.247.94:9289] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.atdotorg.org|F|2"] [data ".atdotorg.org.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.atdotorg.org"] [uri "/mail.atdotorg.org.sql"] [unique_id "atQ0DcIhDdrD4Ou7cP9o-wAAAco"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:06:38
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:06:31.175494 2026] [security2:error] [pid 13151:tid 13151] [client 172.71.247.94:10673] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:06:31.175494 2026] [security2:error] [pid 13151:tid 13151] [client 172.71.247.94:10673] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.joeordie.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.joeordie.com"] [uri "/rezerv.sql"] [unique_id "atQppxNVZMPUlB5rgswfWwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
www.mammazone.it
2026-10-17 01:19:08
(1 week ago)
[Sat Oct 17 03:19:07.938786 2026] [proxy_fcgi:error] [pid 241024] [client 172.71.247.94:11479] AH01071: Got error 'Primary script unknown'
[Sat Oct 17 03:19:08.600169 2026] [proxy_fcgi:error] [pid 241024] [client 172.71.247.94:11479] AH01071: Got err ...
show more
[Sat Oct 17 03:19:07.938786 2026] [proxy_fcgi:error] [pid 241024] [client 172.71.247.94:11479] AH01071: Got error 'Primary script unknown'
[Sat Oct 17 03:19:08.600169 2026] [proxy_fcgi:error] [pid 241024] [client 172.71.247.94:11479] AH01071: Got error 'Primary script unknown'
...
show less
Hacking
🇫🇷
dynamix
2026-10-15 13:02:19
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇮
abdubhai
2026-10-15 04:57:06
(1 week ago)
172.71.247.94 - - [15/Oct/2026:0
...
Brute-Force
🇺🇸
TPI-Abuse
2026-10-14 16:05:27
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:05:19.619055 2026] [security2:error] [pid 29666:tid 29675] [client 172.71.247.94:13610] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:05:19.619055 2026] [security2:error] [pid 29666:tid 29675] [client 172.71.247.94:13610] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bullfrogsmusic.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bullfrogsmusic.com"] [uri "/db.sql"] [unique_id "as-oP07O3zZroCxZ-p2gmAAAAIU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:56:41
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:56:36.789490 2026] [security2:error] [pid 17950:tid 17950] [client 172.71.247.94:13046] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.247.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:56:36.789490 2026] [security2:error] [pid 17950:tid 17950] [client 172.71.247.94:13046] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||fullyevil.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fullyevil.com"] [uri "/fullyevil.com.sql"] [unique_id "as7hVA5oakRQKGwoJM4WVwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
