🇺🇸
TPI-Abuse
2024-04-15 13:30:20
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 15 09:30:14.237850 2024] [security2:error] [pid 5939] [client 199.249.230.121:46754] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||investorscalifornia.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "investorscalifornia.com"] [uri "/daily.sql"] [unique_id "Zh0r5oUuC1eKuee9-IZkngAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
MacLotsen
2024-04-15 12:18:47
(2 years ago)
[Mon Apr 15 14:18:45.566263 2024] [access_compat:error] [pid 1871031] [client 199.249.230.121:47346] ...
show more
[Mon Apr 15 14:18:45.566263 2024] [access_compat:error] [pid 1871031] [client 199.249.230.121:47346] AH01797: client denied by server configuration: /var/www/ingestoffer.nl/xmlrpc.php
[Mon Apr 15 14:18:46.005829 2024] [access_compat:error] [pid 1870408] [client 199.249.230.121:47346] AH01797: client denied by server configuration: /var/www/ingestoffer.nl/xmlrpc.php
[Mon Apr 15 14:18:46.426908 2024] [access_compat:error] [pid 1870410] [client 199.249.230.121:47346] AH01797: client denied by server configuration: /var/www/ingestoffer.nl/xmlrpc.php
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2024-04-15 11:49:45
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 15 07:49:40.341015 2024] [security2:error] [pid 7129] [client 199.249.230.121:38182] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||elgatocapa.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elgatocapa.com"] [uri "/uploads/dump.sql"] [unique_id "Zh0UVAPgpM5sPZsvJ0QgggAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-14 03:47:19
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 13 23:47:14.081789 2024] [security2:error] [pid 13718] [client 199.249.230.121:47484] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||janyoors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "janyoors.com"] [uri "/janyoors-2022.sql"] [unique_id "ZhtRwlmIdT6fQOq0dlKb_AAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-13 02:53:07
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 12 22:52:59.405782 2024] [security2:error] [pid 24913:tid 47978626504448] [client 199.249.230.121:60646] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||woofnrose.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "woofnrose.com"] [uri "/w.sql"] [unique_id "Zhnzi7Sp_3Kxtrnos6Xo9AAAAIM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2024-04-12 22:54:26
(2 years ago)
Form spam
Web Spam
🇺🇸
TPI-Abuse
2024-04-12 02:17:04
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 11 22:17:00.863613 2024] [security2:error] [pid 1164799:tid 47302980970240] [client 199.249.230.121:33976] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||djallskool.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "djallskool.com"] [uri "/skool-2023.sql"] [unique_id "ZhiZnHRzoKX8UDG_KmS-jQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-11 14:26:21
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 11 10:26:14.260411 2024] [security2:error] [pid 6474] [client 199.249.230.121:58020] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kerrywood.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kerrywood.com"] [uri "/errywood.sql"] [unique_id "ZhfzBolLvwBMMJgDUnm7iwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-11 07:30:23
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 11 03:30:17.330356 2024] [security2:error] [pid 4357] [client 199.249.230.121:48614] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||erikageyama.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "erikageyama.com"] [uri "/static/dump.sql"] [unique_id "ZheRiYzB_X9OjOr7lhiVxAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-10 04:39:54
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210730) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 10 00:39:46.874298 2024] [security2:error] [pid 1287] [client 199.249.230.121:34966] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hodlmoser.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hodlmoser.com"] [uri "/backup_backup.sql"] [unique_id "ZhYYEsmIVB-NLtD4XV5INgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-04-09 21:00:40
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇺🇸
TPI-Abuse
2024-04-08 14:51:39
(2 years ago)
(mod_security) mod_security (id:210831) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the la ...
show more
(mod_security) mod_security (id:210831) triggered by 199.249.230.121 (tor2.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 08 10:51:31.831575 2024] [security2:error] [pid 8597] [client 199.249.230.121:60618] [client 199.249.230.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.crystalvisionsart.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.crystalvisionsart.com"] [uri "/robots.txt"] [unique_id "ZhQEc_x-OiQ1mVuPAxuIKwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Kenshin869
2024-02-14 20:56:05
(2 years ago)
Wordpress unauthorized access attempt
Brute-Force
🇩🇪
niceshops.com
2024-02-14 16:18:33
(2 years ago)
Web Attack multi (Feb 24 17:18:32 Matching rules: Detect possible SQL injection - E.g. Waitfor .. D ...
show more
Web Attack multi (Feb 24 17:18:32 Matching rules: Detect possible SQL injection - E.g. Waitfor .. Delay )
show less
SQL Injection
Brute-Force
Bad Web Bot
Web App Attack
🇭🇺
HoneyPotEu
2024-02-13 03:41:02
(2 years ago)
199.249.230.121 [redacted] (62744-QUINTEX United States Westport) - - [13/Feb/2024:04:40:47 +0100] " ...
show more
199.249.230.121 [redacted] (62744-QUINTEX United States Westport) - - [13/Feb/2024:04:40:47 +0100] "POST /xmlrpc.php HTTP/1.1" 401 172 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20
...
show less
Bad Web Bot
Web App Attack