🇺🇸
TPI-Abuse
2025-03-30 23:18:15
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 30 19:18:09.876766 2025] [security2:error] [pid 20455:tid 20479] [client 217.138.202.61:24929] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nobletitles.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nobletitles.org"] [uri "/backups/mysql.sql"] [unique_id "Z-nRMbGsQAjITyEM8c6xBAAAAM4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
COMAITE
2025-03-26 14:21:30
(1 year ago)
Multiple web server 400 error codes from same source ip 217.138.202.61.
Web App Attack
🇦🇺
MAGIC
2025-03-26 06:07:22
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇦🇺
oncord
2025-03-26 05:44:25
(1 year ago)
Form spam
Web Spam
🇺🇸
TPI-Abuse
2025-03-23 21:59:24
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 23 17:59:18.918806 2025] [security2:error] [pid 16524:tid 16524] [client 217.138.202.61:37613] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ilandman.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ilandman.com"] [uri "/backup/mysql.sql"] [unique_id "Z-CENnkyT9H4LabOfhS51gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Mendip_Defender
2025-03-22 22:02:18
(1 year ago)
217.138.202.61 - - [22/Mar/2025:22:02:12 +0000] "HEAD / HTTP/1.0" 301 793 "-" "-"
217.138.202.61 - - ...
show more
217.138.202.61 - - [22/Mar/2025:22:02:12 +0000] "HEAD / HTTP/1.0" 301 793 "-" "-"
217.138.202.61 - - [22/Mar/2025:22:02:12 +0000] "HEAD / HTTP/1.0" 200 950 "-" "-"
217.138.202.61 - - [22/Mar/2025:22:02:14 +0000] "HEAD / HTTP/1.0" 200 950 "-" "-"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-03-21 21:10:30
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 21 17:10:25.919736 2025] [security2:error] [pid 1167682:tid 1167682] [client 217.138.202.61:24701] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "keychainfilms.com"] [uri "/sftp-config.json"] [unique_id "Z93VwTsbWx4jcMfaHFyibAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
CryptoYakari
2025-03-19 15:26:43
(1 year ago)
217.138.202.61 - - [19/Mar/2025:18:26:37 +0300] "GET /restore/directory.zip HTTP/1.0" 404 28932 "-" ...
show more
217.138.202.61 - - [19/Mar/2025:18:26:37 +0300] "GET /restore/directory.zip HTTP/1.0" 404 28932 "-" "-"
217.138.202.61 - - [19/Mar/2025:18:26:39 +0300] "GET /www.gz HTTP/1.0" 404 28795 "-" "-"
217.138.202.61 - - [19/Mar/2025:18:26:39 +0300] "HEAD /backups/sftp-config.json HTTP/1.0" 404 436 "-" "-"
217.138.202.61 - - [19/Mar/2025:18:26:40 +0300] "GET /back/bak.tar.gz HTTP/1.0" 404 28875 "-" "-"
217.138.202.61 - - [19/Mar/2025:18:26:42 +0300] "GET /backup.sql.tar HTTP/1.0" 404 28874 "-" "-"
...
show less
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
🇹🇷
rtbh.com.tr
2025-03-18 20:48:49
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇺🇸
Penny Packer
2025-03-18 10:19:07
(1 year ago)
Fail2Ban apache-tripwires
Web App Attack
🇹🇷
rtbh.com.tr
2025-03-17 20:48:51
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇺🇸
TPI-Abuse
2025-03-17 16:18:28
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 17 12:18:22.435204 2025] [security2:error] [pid 4702:tid 4702] [client 217.138.202.61:13813] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||swhowell.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "swhowell.com"] [uri "/restore/sql.sql"] [unique_id "Z9hLTnKcWLwj8CKc5KG4jgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
diego
2025-03-17 09:16:41
(1 year ago)
Events: TCP SYN Discovery or Flooding, Seen 5 times in the last 10800 seconds
DDoS Attack
🇧🇷
diego
2025-03-17 06:28:35
(1 year ago)
Events: TCP SYN Discovery or Flooding, Seen 6 times in the last 10800 seconds
DDoS Attack
🇧🇷
diego
2025-03-17 04:07:27
(1 year ago)
Events: TCP SYN Discovery or Flooding, Seen 4 times in the last 10800 seconds
DDoS Attack