🇳🇱
Linuxmalwarehuntingnl
2024-07-03 09:00:19
(2 years ago)
Unauthorized connection attempt
Brute-Force
🇺🇸
TPI-Abuse
2024-04-10 14:21:24
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 10 10:21:20.429842 2024] [security2:error] [pid 26457] [client 185.91.127.13:509 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 10 10:21:20.429842 2024] [security2:error] [pid 26457] [client 185.91.127.13:50922] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jessiedavison.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jessiedavison.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZhagYE9LlCvXagQCEmKsNwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-03 06:42:31
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 03 02:42:27.038740 2024] [security2:error] [pid 19220] [client 185.91.127.13:547 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 03 02:42:27.038740 2024] [security2:error] [pid 19220] [client 185.91.127.13:54762] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cier.xyz|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cier.xyz"] [uri "/site/default/settings.php.BAK"] [unique_id "Zgz6U1zvPzLF7QGEETpipQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2024-04-03 06:02:21
(2 years ago)
Attack against Apache (too many 404s)
Web App Attack
🇳🇱
Savvii
2024-04-03 03:10:57
(2 years ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 23:48:20
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 19:48:16.049826 2024] [security2:error] [pid 32576] [client 185.91.127.13:635 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 19:48:16.049826 2024] [security2:error] [pid 32576] [client 185.91.127.13:63539] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||ostarek.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ostarek.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgyZQBE_grP8zFyYuCV5IQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 22:45:52
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 18:45:48.814454 2024] [security2:error] [pid 25313] [client 185.91.127.13:570 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 18:45:48.814454 2024] [security2:error] [pid 25313] [client 185.91.127.13:57020] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||livesteamtracks.info|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "livesteamtracks.info"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgyKnI1l5aT5WKusU6hU5QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 22:19:34
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 18:19:30.926347 2024] [security2:error] [pid 499] [client 185.91.127.13:57563 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 18:19:30.926347 2024] [security2:error] [pid 499] [client 185.91.127.13:57563] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||restlessgirl.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "restlessgirl.net"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgyEcqgzbl_HZFRRXAddDAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 21:41:50
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 17:41:45.976523 2024] [security2:error] [pid 3870] [client 185.91.127.13:6421 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 17:41:45.976523 2024] [security2:error] [pid 3870] [client 185.91.127.13:64214] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cnwire.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cnwire.com"] [uri "/site/default/settings.php.BAK"] [unique_id "Zgx7mbAmYuphFvYdQ4GWxwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
bigscoots.com
2024-04-02 21:00:23
(2 years ago)
(PERMBLOCK) 185.91.127.13 (GB/United Kingdom/tube-hosting.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-04-02 19:47:36
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 15:47:31.403584 2024] [security2:error] [pid 4605] [client 185.91.127.13:5907 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 15:47:31.403584 2024] [security2:error] [pid 4605] [client 185.91.127.13:59073] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sweetvalleypendant.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sweetvalleypendant.com"] [uri "/site/default/settings.php.BAK"] [unique_id "Zgxg06Z8hcjY-9hjMUGrrQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 19:03:05
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 15:02:58.207610 2024] [security2:error] [pid 17499] [client 185.91.127.13:542 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 15:02:58.207610 2024] [security2:error] [pid 17499] [client 185.91.127.13:54234] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ineedafriend.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ineedafriend.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgxWYqXfOmcHAdlZG5M1ogAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-04-02 18:51:03
(2 years ago)
Bot / scanning and/or hacking attempts: GET /admin.php HTTP/1.1, GET /mini.php HTTP/1.1, GET /upload.php HTTP/1.1, GET /wp.php HTTP/1.1, GET /themes.php HTTP/1.1, GET /smm.php HTTP/1.1, GET /wp-content/plugins/index.php HTTP/1.1, GET /wp-content/inde ...
show more
Bot / scanning and/or hacking attempts: GET /admin.php HTTP/1.1, GET /mini.php HTTP/1.1, GET /upload.php HTTP/1.1, GET /wp.php HTTP/1.1, GET /themes.php HTTP/1.1, GET /smm.php HTTP/1.1, GET /wp-content/plugins/index.php HTTP/1.1, GET /wp-content/index.php HTTP/1.1, GET /classwithtostring.php HTTP/1.1, GET /1.php HTTP/1.1, GET /gecko.php HTTP/1.1, GET /cloud.php HTTP/1.1, GET /log.php HTTP/1.1, GET /0z.php HTTP/1.1, GET /wp-admin/css/colors/blue/CasperExV1.php HTTP/1.1, GET /user.php HTTP/1.1, GET /edit-comments.php HTTP/1.1, GET /xl2023.php HTTP/1.1, GET /lufix.php HTTP/1.1, GET /byp.php HTTP/1.1, GET /about.php HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2024-04-02 16:34:39
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 12:34:33.120330 2024] [security2:error] [pid 7317] [client 185.91.127.13:6300 ...
show more
(mod_security) mod_security (id:210730) triggered by 185.91.127.13 (tube-hosting.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 02 12:34:33.120330 2024] [security2:error] [pid 7317] [client 185.91.127.13:63005] [client 185.91.127.13] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||artsafloat.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artsafloat.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgwzmecO3wMgeTKt6Xt6EAAAAFY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-04-02 16:32:30
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH