🇺🇸
TPI-Abuse
2026-01-17 07:38:01
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 02:37:54.647865 2026] [security2:error] [pid 2986:tid 2986] [client 216.10.27.198:55941] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.stage"] [unique_id "aWs8Uo4UAVYjjurFHb7ybAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 17:49:10
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:48:56.598836 2025] [security2:error] [pid 30284:tid 30620] [client 216.10.27.198:47129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kettlehill.com"] [uri "/wp-content/plugins/wpsite-background-takeover/exports/download.php"] [unique_id "aVK_CDko7uys3oTtjZtm9QAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 08:54:57
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 03:54:49.821181 2025] [security2:error] [pid 28386:tid 28386] [client 216.10.27.198:54489] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/roundcube/logs/errors.log"] [unique_id "aRWc2Xka-Um4GsBjSNaaTwAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-27 00:29:05
(10 months ago)
(mod_security) mod_security (id:221260) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:221260) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:28:57.277301 2025] [security2:error] [pid 172228:tid 172424] [client 216.10.27.198:33199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||cpanel.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kettlehill.com"] [uri "/cgi-bin/status/status.cgi"] [unique_id "aIVyyeyxIbVHpqlXWTqOmQAAAM0"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-05-27 03:47:22
(2 years ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇪🇸
10dencehispahard SL
2024-05-08 07:00:43
(2 years ago)
Unauthorized login attempts []
Brute-Force
🇪🇸
10dencehispahard SL
2024-05-08 06:42:34
(2 years ago)
Web Attack
DDoS Attack
Brute-Force
Web App Attack
🇪🇸
10dencehispahard SL
2024-03-27 07:00:25
(2 years ago)
Unauthorized login attempts [ BI-16635]
Brute-Force
🇪🇸
10dencehispahard SL
2024-03-27 06:46:44
(2 years ago)
WP scan
Web App Attack
🇺🇸
TPI-Abuse
2024-02-13 23:57:09
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 13 18:54:52.887861 2024] [security2:error] [pid 13159:tid 46964693591808] [client 216.10.27.198:50925] [client 216.10.27.198] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kettlehill.net"] [uri "/.env.save"] [unique_id "ZcwBTBLdQ7ghlPWmv_jSlwAAAVU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-01-25 21:25:55
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 25 16:24:44.842043 2024] [security2:error] [pid 17203] [client 216.10.27.198:55133] [client 216.10.27.198] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stdavids-media.com"] [uri "/wp-config.php-backup"] [unique_id "ZbLRnLFnTXThqLKvrK0EIAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2023-11-28 23:31:58
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.10.27.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 28 18:30:30.400539 2023] [security2:error] [pid 31708:tid 47281292199680] [client 216.10.27.198:52035] [client 216.10.27.198] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.staging.kettlehill.com"] [uri "/wp-config.php.dist"] [unique_id "ZWZ4Fvhjua4Um2B4ADQ7sQAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2023-11-27 13:10:05
(2 years ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
ChamberofCommerce.com
2023-11-06 05:37:23
(2 years ago)
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ...
show more
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226
show less
Bad Web Bot
🇺🇸
ChamberofCommerce.com
2023-10-30 20:17:14
(2 years ago)
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ...
show more
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226
show less
Bad Web Bot