🇺🇸
TPI-Abuse
2026-10-24 07:37:59
(4 days ago)
(mod_security) mod_security (id:212620) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 03:37:52.653987 2026] [security2:error] [pid 1225:tid 1225] [client 193.31.125.247:49195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||indie100.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /index.html?p=<script>alert(1)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "indie100.com"] [uri "/index.html"] [unique_id "atxgUFtzZqu1v4Wte2o56QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 02:47:32
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 22:41:57.090548 2026] [security2:error] [pid 20149:tid 20360] [client 193.31.125.247:59381] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.kettlehill.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.kettlehill.com"] [uri "/src.db"] [unique_id "ar3IdQdJy4plhLM8JBDU7AAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-09-19 06:36:46
(1 month ago)
Scanning for web/db/file exploits on tpc-031.mach3builders.nl
SQL Injection
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-08-23 01:29:05
(2 months ago)
Scanning for web/db/file exploits on tpc-031.mach3builders.nl
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 04:29:50
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 00:29:45.672494 2026] [security2:error] [pid 24244:tid 24281] [client 193.31.125.247:40449] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.kettlehill.net"] [uri "/logs/error.log"] [unique_id "akXpOcVqafY74aTf9-BVPAAAAk8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-01 11:25:09
(8 months ago)
(mod_security) mod_security (id:240950) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240950) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:25:01.969922 2026] [security2:error] [pid 16722:tid 16905] [client 193.31.125.247:43083] ModSecurity: Access denied with code 403 (phase 1). Pattern match "\\\\D" at TX:1. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "4530"] [id "240950"] [rev "2"] [msg "COMODO WAF: XSS & SQL injection vulnerability in Pragyan CMS 3.0 (CVE-2015-1471)||www.staging.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "staging.kettlehill.com"] [uri "/secure/QueryComponentRendererValue!Default.jspa"] [unique_id "aX84DcyMbG6v0xSDvGJVIgAAAtM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-01 21:30:10
(10 months ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-12-01 05:50:58
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 00:50:36.466985 2025] [security2:error] [pid 26090:tid 26470] [client 193.31.125.247:45537] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.com"] [uri "/.env.backup"] [unique_id "aS0srAqR0geke5MRGl4F0AAAAJg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-01 15:05:52
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 193.31.125.247 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 11:05:46.137070 2025] [security2:error] [pid 15497:tid 15515] [client 193.31.125.247:33473] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.net|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.net"] [uri "/ssl/localhost.key"] [unique_id "aQYhyj8P3DuTvo3jZlb2rwAAAEw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
MatStef132
2025-05-20 12:46:40
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET m ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
show less
Bad Web Bot
