🇺🇸
TPI-Abuse
2025-12-29 18:36:49
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 13:36:42.024660 2025] [security2:error] [pid 25028:tid 25061] [client 193.42.224.42:36843] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.net"] [uri "/\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\windows\\\\win.ini"] [unique_id "aVLKOnoCEO1cw_Cklci32wAAAdc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 09:06:38
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 04:05:46.415135 2025] [security2:error] [pid 29007:tid 29007] [client 193.42.224.42:50537] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/backup.sql"] [unique_id "aRWfapX1-wttVwisv_XAFwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 00:18:40
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:18:27.324995 2025] [security2:error] [pid 172229:tid 172480] [client 193.42.224.42:48765] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.kettlehill.com"] [uri "/.env.save"] [unique_id "aIVwU-Zd-uShJ73phjvrpwAAAQ8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 21:12:48
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 17:12:40.949893 2025] [security2:error] [pid 3527529:tid 3527529] [client 193.42.224.42:48209] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.farmers123.com"] [uri "/wp-config.php.old"] [unique_id "aDjNyIZvibkfKT3Vmzzz-AAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Vincent Helmus
2025-05-16 17:40:19
(1 year ago)
ALL
DNS Compromise
DNS Poisoning
Fraud Orders
DDoS Attack
FTP Brute-Force
Ping of Death
Phishing
Fraud VoIP
Open Proxy
Web Spam
Email Spam
Blog Spam
VPN IP
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇳🇱
Cyber SOC
2025-04-22 08:51:21
(1 year ago)
Peaksys - 2025-04-22 09:49:37 UTC+01
Hacking
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-19 03:14:53
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 18 23:14:44.433752 2025] [security2:error] [pid 21920:tid 22031] [client 193.42.224.42:42963] [client 193.42.224.42] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.spinningdesigns.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.spinningdesigns.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "aAMVJBuYowtSVCxTM-GzZwAAAhI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-03-29 10:58:21
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-02-27 14:54:28
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 27 09:53:11.418851 2025] [security2:error] [pid 27063:tid 27214] [client 193.42.224.42:60551] [client 193.42.224.42] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/errors.log"] [unique_id "Z8B8V8nGgNPGej7DPucMcwAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-04-16 00:32:05
(2 years ago)
Common attack or app scan event detected and blocked
Port Scan
Hacking
Web App Attack
🇪🇸
10dencehispahard SL
2024-03-27 07:00:25
(2 years ago)
Unauthorized login attempts [ BI-16635]
Brute-Force
🇪🇸
10dencehispahard SL
2024-03-27 06:43:19
(2 years ago)
WP scan
Web App Attack
🇺🇸
TPI-Abuse
2024-02-13 23:53:21
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 13 18:53:15.353559 2024] [security2:error] [pid 13159:tid 46964589438720] [client 193.42.224.42:48863] [client 193.42.224.42] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.staging.kettlehill.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "staging.kettlehill.com"] [uri "/.../.../.../.../.../.../.../.../.../windows/win.ini"] [unique_id "ZcwA6xLdQ7ghlPWmv_jOAQAAAUQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-01-25 21:25:19
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 25 16:24:33.777460 2024] [security2:error] [pid 17163] [client 193.42.224.42:41807] [client 193.42.224.42] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||stdavids-media.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stdavids-media.com"] [uri "/dbdump.sql"] [unique_id "ZbLRkfPQ7uaBMIY1soT0hQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2023-11-28 23:29:37
(2 years ago)
(mod_security) mod_security (id:211190) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 193.42.224.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 28 18:27:44.084368 2023] [security2:error] [pid 30608:tid 47740235687680] [client 193.42.224.42:41077] [client 193.42.224.42] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /catalog.php?filename=../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kettlehill.com"] [uri "/catalog.php"] [unique_id "ZWZ3cFPUS3vICgG3-vR8NwAAAMA"], referer: http://www.kettlehill.com/catalog.php?filename=../../../../../../../../../etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack