🇨🇭
Kepler-1649c
2026-09-22 10:06:48
(1 month ago)
Detected Attack: Generic.Path.Traversal.Detection
Hacking
🇺🇸
wasuma
2026-05-19 14:25:23
(5 months ago)
Honeypot: Apache path traversal RCE — systematic probe for CVE-2021-41773. No payload delivered yet.
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-01-17 19:33:20
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 14:33:14.884158 2026] [security2:error] [pid 17226:tid 17226] [client 209.242.201.95:41575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.cpcalendars"] [unique_id "aWvj-oLE_hLj6gJKJy1yewAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 20:13:03
(9 months ago)
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 15:12:58.558202 2025] [security2:error] [pid 29977:tid 29995] [client 209.242.201.95:47441] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.kettlehill.net|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp"] [unique_id "aVLgyjWelXmsIDHwJWYN3AAAAZA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-15 09:31:58
(11 months ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-11-13 08:58:20
(11 months ago)
(mod_security) mod_security (id:212620) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:212620) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 03:58:01.534665 2025] [security2:error] [pid 2342:tid 2342] [client 209.242.201.95:52455] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /?s=\\x22/></script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.nbcnewsradio.com"] [uri "/"] [unique_id "aRWdmRSNDzy84QKlMaKEpgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dpsbs
2025-10-14 08:55:54
(1 year ago)
multiple ips intrustions detected
Hacking
🇺🇸
TPI-Abuse
2025-10-01 17:11:46
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 13:11:37.175285 2025] [security2:error] [pid 30110:tid 30164] [client 209.242.201.95:36773] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kettlehill.com"] [uri "/.env.dev"] [unique_id "aN1gyckWrLLgoGKIU59NHgAAAdM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 00:14:41
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:13:16.970806 2025] [security2:error] [pid 172229:tid 172467] [client 209.242.201.95:52203] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||kettlehill.net|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_jcollection&controller=../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.net"] [uri "/index.php"] [unique_id "aIVvHOZd-uShJ73phjvWQQAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 15:35:19
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 11:35:13.340532 2025] [security2:error] [pid 2892934:tid 2892934] [client 209.242.201.95:49525] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.farmers123.com|F|2"] [data ".com.db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.farmers123.com"] [uri "/farmers123.com.db"] [unique_id "aDh-sUCtTd7km9_cEQhBfQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dayda.net
2025-05-22 06:16:38
(1 year ago)
page=acymailing_front&ctrl=frontusers&ctrl=frontusers&noheader=1&user[email][email protected] &task=s ...
show more
page=acymailing_front&ctrl=frontusers&ctrl=frontusers&noheader=1&user[email][email protected] &task=subscribe&option=acymailing&redirect=https://example.com&ajax=0&acy_source=widget%202&hiddenlists=1&acyformname=formAcym93841&acysubmode=widget_acym
show less
Bad Web Bot
🇩🇪
dayda.net
2024-12-04 02:51:32
(1 year ago)
rsd=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Bad Web Bot
🇺🇸
TPI-Abuse
2024-11-26 23:07:58
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 26 18:06:03.996175 2024] [security2:error] [pid 10370:tid 10447] [client 209.242.201.95:35983] [client 209.242.201.95] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.staging.kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staging.kettlehill.com"] [uri "/index.php"] [unique_id "Z0ZUW7wn3XoUAq69aQZF2QAAANM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-09-04 03:05:13
(2 years ago)
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 209.242.201.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 23:05:04.514230 2024] [security2:error] [pid 1412:tid 1412] [client 209.242.201.95:45345] [client 209.242.201.95] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.stdavids-media.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../../../../../../../../../etc/passwd;%22"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stdavids-media.com"] [uri "/cgi-bin/kerbynet"] [unique_id "ZtfOYEoPdbwOsLGNBLcg5AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-08-27 00:35:02
(2 years ago)
| A web attack returned code 200 (success).
Hacking
SQL Injection
Web App Attack