🇺🇸
TPI-Abuse
2026-10-02 09:27:30
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:27:26.309528 2026] [security2:error] [pid 9513:tid 9513] [client 212.227.140.81:55965] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.eileensinc.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.eileensinc.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar94_q2JCiPtVsKAl0IH6wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 04:52:39
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 00:52:31.700462 2026] [security2:error] [pid 12988:tid 12988] [client 212.227.140.81:63611] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.stevedegroodt.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.stevedegroodt.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar84jz7SGu6LdkzQF6CJAQAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 04:34:34
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 00:34:26.853232 2026] [security2:error] [pid 16520:tid 16520] [client 212.227.140.81:64792] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.rjdyckarchitect.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.rjdyckarchitect.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar80UsypJilp91BJnscDGQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 04:13:41
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 00:13:35.641960 2026] [security2:error] [pid 23399:tid 23399] [client 212.227.140.81:61467] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.wizind.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.wizind.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar8vbxrzzHRzeibhKymL4gAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 02:27:18
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 22:27:11.617109 2026] [security2:error] [pid 11273:tid 11273] [client 212.227.140.81:52213] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.admcolumbus.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.admcolumbus.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar8WfzOWS19opFU48GT-0AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 19:06:20
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 15:06:12.948572 2026] [security2:error] [pid 14481:tid 14481] [client 212.227.140.81:61288] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.gonzalez.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.gonzalez.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar6vJNgrV2usOtVAoLtCZAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 16:28:12
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 12:28:06.373595 2026] [security2:error] [pid 31911:tid 31911] [client 212.227.140.81:57374] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.tdsdemo.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.tdsdemo.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar6KFvvhbBk6hAzrWYTDAwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 15:57:25
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:57:17.515438 2026] [security2:error] [pid 16750:tid 16750] [client 212.227.140.81:59678] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.netcastcorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.netcastcorp.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar6C3bzy7xubebY_HMDIYwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 15:17:34
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 212.227.140.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 11:17:29.582688 2026] [security2:error] [pid 1156:tid 1156] [client 212.227.140.81:58238] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.wallpaperpro.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.wallpaperpro.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ar55iZFt7IIKOWvf6h_cAAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-30 13:56:02
(2 days ago)
Web application attack detected.
Web App Attack
🇷🇴
clauss
2026-09-30 03:46:09
(3 days ago)
212.227.140.81 - - [30/Sep/2026:06:46:08 +0300] "GET /owa/ HTTP/1.1" 400 63 "-" "Rust-Engine-OWA-Dis ...
show more
212.227.140.81 - - [30/Sep/2026:06:46:08 +0300] "GET /owa/ HTTP/1.1" 400 63 "-" "Rust-Engine-OWA-Discover/1.0"
212.227.140.81 - - [30/Sep/2026:06:46:09 +0300] "GET /owa/ HTTP/1.1" 403 146 "-" "Rust-Engine-OWA-Discover/1.0"
...
show less
Web App Attack
🇦🇹
joe-abuse
2026-09-30 01:36:00
(3 days ago)
Automated report from fail2ban on www.fitzgerald.eu. Jail: apache-badpaths. First seen: 2026-09-29 1 ...
show more
Automated report from fail2ban on www.fitzgerald.eu. Jail: apache-badpaths. First seen: 2026-09-29 12:00:22. Events: 1. Reported by ipdb-security/fitzgerald.eu
show less
Web App Attack
2026-09-29 09:05:35
(3 days ago)
Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=8
Hacking
🇺🇸
NXTwoThou
2026-09-29 02:11:00
(4 days ago)
/autodiscover/autodiscover.xml
Web App Attack
🇩🇪
LRob
2026-09-28 20:30:13
(4 days ago)
Vulnerability scanning | method: GET | path: /owa/ | ua: Rust-Engine-OWA-Discover/1.0
Port Scan
Web App Attack
