🇭🇷
bubausluge
2026-10-18 23:18:37
(3 days ago)
Blocked by https://aegis.hr — WAF: LFI/RFI - (MITRE T1190), 1 attempts, Period: 2026-10-18 22:58:36 ...
show more
Blocked by https://aegis.hr — WAF: LFI/RFI - (MITRE T1190), 1 attempts, Period: 2026-10-18 22:58:36 to 2026-10-18 22:58:36
show less
Web App Attack
Hacking
🇫🇷
bigorre.org
2026-06-17 15:42:17
(4 months ago)
Excessive crawling : exceed crawl-delay defined in robots.txt
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-28 18:23:48
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 14:23:40.062219 2026] [security2:error] [pid 16333:tid 16333] [client 172.98.168.121:35613] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||boat-registration-greece.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "boat-registration-greece.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahiILCcMjkRns3esed-sGwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-17 05:57:45
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 00:57:38.653968 2026] [security2:error] [pid 17208:tid 17208] [client 172.98.168.121:57069] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/wp-config.php~"] [unique_id "aWsk0gYmS1KMgPJSVbkg5gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 18:23:37
(9 months ago)
(mod_security) mod_security (id:221260) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:221260) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 13:22:50.599208 2025] [security2:error] [pid 30274:tid 30542] [client 172.98.168.121:56303] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||ftp.kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/403.shtml"] [unique_id "aVLG-kPUzqrf53yng5XQ-wAAAIA"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 09:49:36
(11 months ago)
(mod_security) mod_security (id:211190) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 04:49:26.229135 2025] [security2:error] [pid 25968:tid 25968] [client 172.98.168.121:55825] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?file=http://0177.0.0.1/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/"] [unique_id "aRWppm41lrFcvBGzlRyuHgAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 00:26:50
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:26:43.627987 2025] [security2:error] [pid 291259:tid 291312] [client 172.98.168.121:59779] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.staging.kettlehill.com"] [uri "/a.htaccess"] [unique_id "aIVyQ2QX5AgegSXcd9ra-AAAAQc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 22:31:19
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.98.168.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:31:12.667833 2025] [security2:error] [pid 3643812:tid 3643812] [client 172.98.168.121:34747] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.farmers123.com"] [uri "/.env.www"] [unique_id "aDjgMBS6FNV0F6xnGvmamgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-02-09 08:49:34
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
2025-01-15 07:11:32
(1 year ago)
| A web attack returned code 200 (success).
Hacking
SQL Injection
Web App Attack