🇺🇸
TPI-Abuse
2026-06-01 01:56:40
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:54:08.290917 2026] [security2:error] [pid 6154:tid 6338] [client 191.101.41.76:37793] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.kettlehill.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.kettlehill.com"] [uri "/header.php.bak"] [unique_id "ahzmQIIOo6_fQuyz0hl0vQAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-01 11:36:16
(4 months ago)
(mod_security) mod_security (id:212620) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:34:26.950994 2026] [security2:error] [pid 16722:tid 16893] [client 191.101.41.76:46293] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||mail.kettlehill.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /ajax/apps/manifests?action=all&format=debug&xss=<script>alert(document.domain);</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "mail.kettlehill.com"] [uri "/ajax/apps/manifests"] [unique_id "aX86QsyMbG6v0xSDvGJgGgAAAsc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 16:33:45
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 11:33:27.361242 2026] [security2:error] [pid 2934:tid 2934] [client 191.101.41.76:59281] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/server.key"] [unique_id "aWpoV3uVRZyvqS_LTf3_vwAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-01 06:39:27
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 01:39:24.919398 2025] [security2:error] [pid 8488:tid 8555] [client 191.101.41.76:33579] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kettlehill.com"] [uri "/_.htaccess"] [unique_id "aS04HNZHHfu_5jcVG6ppQQAAAYA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-12 11:41:02
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 06:40:59.518352 2025] [security2:error] [pid 7164:tid 7164] [client 191.101.41.76:50771] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.nbcnewsradio.com"] [uri "/.git/config"] [unique_id "aRRyS9ibRRAyPHXFN9FsUQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 14:43:55
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 10:43:42.789391 2025] [security2:error] [pid 12475:tid 12495] [client 191.101.41.76:34201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.com"] [uri "/.env.kettlehill"] [unique_id "aN0-HmCKjmgjI9kURFKAnQAAAVA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-26 04:44:35
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 26 00:44:29.409828 2025] [security2:error] [pid 19244:tid 19244] [client 191.101.41.76:42217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.deandobkin.com"] [uri "/.env.production"] [unique_id "aNYaLcus2GOOA9Kv-TneMAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-08-02 03:50:02
(10 months ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 06:38:58
(10 months ago)
(mod_security) mod_security (id:211190) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 02:38:52.724588 2025] [security2:error] [pid 3331447:tid 3331461] [client 191.101.41.76:50287] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.staging.kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?__kubio-site-edit-iframe-preview=1&__kubio-site-edit-iframe-classic-template=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staging.kettlehill.com"] [uri "/"] [unique_id "aIxg_FSZjg6lcpTf51ZT3AAAAYo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 09:59:03
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 05:58:58.314794 2025] [security2:error] [pid 2863389:tid 2863488] [client 191.101.41.76:49967] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/db.php.bak"] [unique_id "aDwkYh8IXHoSGgIBxJgvegAAAIs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-28 20:36:29
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 191.101.41.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 28 16:36:20.503836 2025] [security2:error] [pid 1865551:tid 1865551] [client 191.101.41.76:57345] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.farmers123.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.farmers123.com"] [uri "/errors.log"] [unique_id "aDdzxBUbr5HjhYOPuB9pxAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
0xffffffff
2024-03-23 21:26:48
(2 years ago)
[2024-03-23 23:26:45.262480] [authz_core:error] [pid 195284:tid 140633274717760] [client 191.101.41. ...
show more
[2024-03-23 23:26:45.262480] [authz_core:error] [pid 195284:tid 140633274717760] [client 191.101.41.76:0] AH01630: client denied by server configuration: /var/www/*/wp-admin/maint/termps.php, referer http://*//wp-admin/maint/termps.php , error_notes:double-slash , URI:'/wp-admin/maint/termps.php'
[2024-03-23 23:26:45.671822] [authz_core:error] [pid 195284:tid 140633266308672] [client 191.101.41.76:0] AH01630: client denied by server configuration: /var/www/*/cgi-bin, referer http://*//cgi-bin/class_api.php , error_notes:double-slash , URI:'/cgi-bin/class_api.php'
[2024-03-23 23:26:46.076457] [authz_core:error] [pid 195284:tid 140633257899584] [client 191.101.41.76:0] AH01630: client denied by server configuration: /var/www/*/class_api.php, referer http://*//class_api.php , error_notes:double-slash , URI:'/class_api.php'
[2024-03-23 23:26:46.494217] [authz_core:error] [pid 195284:tid 140633249490496] [client 191.101.41.76:0] AH01630: client denied by server configuration: /var/www/*/.well-known/acme-challenge,
show less
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2024-03-23 20:09:26
(2 years ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
ChamberofCommerce.com
2024-03-22 16:06:13
(2 years ago)
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ...
show more
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226
show less
Bad Web Bot
2024-03-21 08:40:06
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH