|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 07:28:15.027388 2026] [security2:error] [pid 18781:tid 18781] [client 184.174.56.248:54995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.bak"] [unique_id "aWuAX3j-kkjO83rSIITgJAAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:221260) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:221260) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:55:30.291740 2025] [security2:error] [pid 30284:tid 30632] [client 184.174.56.248:36759] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||webmail.kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kettlehill.net"] [uri "/"] [unique_id "aVLAkjko7uys3oTtjZtqugAAAM4"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212750) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212750) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 09:08:01.583582 2025] [security2:error] [pid 29431:tid 29431] [client 184.174.56.248:41433] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: onerror= found within REQUEST_URI: /webmail/?language=\\x22><img src=x onerror=alert(1)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.nbcnewsradio.com"] [uri "/webmail/"] [unique_id "aRXmQagMpbUD5VKhre2KWgAAAB0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:44:48.837068 2024] [security2:error] [pid 17898:tid 17898] [client 184.174.56.248:42801] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.stdavids-media.com"] [uri "/.env.local"] [unique_id "ZtdZIJs9LvraTS9zUNijvwAAAAs"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212620) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 31 21:59:55.233807 2024] [security2:error] [pid 3218518:tid 3218548] [client 184.174.56.248:55399] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||kettlehill.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /system/login/sysloginuser.aspx?login=denied&uid=</script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "kettlehill.net"] [uri "/system/login/SysLoginUser.aspx"] [unique_id "ZtPKm_U2CFh7XASDQ7RfCAAAABU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇩🇪
ps-center
|
|
SS1: Web Attack GET /../../../../../../../../etc/passwd
|
Web Spam
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ accesslogs]
|
Brute-Force
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212620) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 27 03:06:07.671791 2024] [security2:error] [pid 31360:tid 47386378376960] [client 184.174.56.248:49979] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_COOKIES:svpnlang. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||ftp.kettlehill.com|F|2"] [data "Matched Data: <script found within REQUEST_COOKIES:svpnlang: <script>alert('document.domain')</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.kettlehill.com"] [uri "/wnm/login/login.json"] [unique_id "Zn0PX1yO989uQdQJj5NUHQAAARA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ accesslogs]
|
Brute-Force
|
|
|
Anonymous
|
|
Common attack or app scan event detected and blocked
|
Port Scan
Hacking
Web App Attack
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ BI-16635]
|
Brute-Force
|
|
|
🇪🇸
10dencehispahard SL
|
|
WP scan
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 22 19:18:18.225298 2024] [security2:error] [pid 3185:tid 47476889454336] [client 184.174.56.248:39963] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.com"] [uri "/logs/error.log"] [unique_id "Zf4RusfgGGM3LUQZLUnUOwAAAVg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 25 16:24:01.087213 2024] [security2:error] [pid 32505] [client 184.174.56.248:50939] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||stdavids-media.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stdavids-media.com"] [uri "/theme/META-INF/prototype\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xaf..\\xc0\\xafwindows/win.ini"] [unique_id "ZbLRcboF3S5HRUikLswOCAAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 184.174.56.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 12 18:06:11.815114 2023] [security2:error] [pid 22356:tid 46962285389568] [client 184.174.56.248:42859] [client 184.174.56.248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.net"] [uri "/wp-config.php.save"] [unique_id "ZXjnY-lzNZ3kieRyxpVMKQAAAYA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|