🇩🇪
updown.io
2026-11-07 20:05:13
UTC ·
(2 days ago)
{"level":"info","ts":1794081912.382633,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"217.76.48.52","remote_port":"22797","client_ip":"217.76.48.52","proto":"HTTP/1.1","method":"GET","host":"grist.statut.mte.incubateu ...
show more
{"level":"info","ts":1794081912.382633,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"217.76.48.52","remote_port":"22797","client_ip":"217.76.48.52","proto":"HTTP/1.1","method":"GET","host":"grist.statut.mte.incubateur.net","uri":"/secureader/javax.faces.resource/web.xml?loc=../WEB-INF","headers":{"Accept-Language":["en"],"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.000082026,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://grist.statut.mte.incubateur.net/secureader/javax.faces.resource/web.xml?loc=../WEB-INF"],"Content-Type":[]}}
{"level":"info","ts":1794081912.4129267,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"217.76.48.52","remote_port":"56905","client_ip":"217.76.48.52","proto":
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 21:25:36
UTC ·
(3 days ago)
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:25:31.296389 2026] [security2:error] [pid 2831809:tid 2831915] ...
show more
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 16:25:31.296389 2026] [security2:error] [pid 2831809:tid 2831915] [client 217.76.48.52:15765] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||www.abadie.com.uy:80|F|2"] [data "/guest_auth/guestisup.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.abadie.com.uy"] [uri "/guest_auth/guestIsUp.php"] [unique_id "au5FywkgNgeRRMJK6VI_2gAAARA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇱
spd.co.il
2026-11-06 16:01:37
UTC ·
(3 days ago)
Web application attack detected
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 08:13:30
UTC ·
(3 days ago)
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:13:22.918145 2026] [security2:error] [pid 13925:tid 13925] [cli ...
show more
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 03:13:22.918145 2026] [security2:error] [pid 13925:tid 13925] [client 217.76.48.52:16630] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||cpcalendars.iat.com.pa:80|F|2"] [data "/guest_auth/guestisup.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "cpcalendars.iat.com.pa"] [uri "/guest_auth/guestIsUp.php"] [unique_id "au2MIjy20ixwD_TTPLBDawAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-05 13:17:24
UTC ·
(4 days ago)
Web attack/malicious scanning detected
Web App Attack
🇮🇱
spd.co.il
2026-11-01 00:03:12
UTC ·
(1 week ago)
Web application attack detected
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 17:33:17
UTC ·
(1 week ago)
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:33:13.611155 2026] [security2:error] [pid 7612:tid 7612] [clien ...
show more
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:33:13.611155 2026] [security2:error] [pid 7612:tid 7612] [client 217.76.48.52:23794] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||cmcgroup.us.com:443|F|2"] [data "/guest_auth/guestisup.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "cmcgroup.us.com"] [uri "/guest_auth/guestIsUp.php"] [unique_id "auYmWdFPjLG2p1VbYKnlwwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-29 21:30:10
UTC ·
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-29 18:28:25
UTC ·
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted] 217.76.48.52 (GB/United Kingdom/vmi3672677.contaboserver.net): (CF_ENABLE)
SQL Injection
🇺🇸
TPI-Abuse
2026-10-29 05:53:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 01:53:51.816306 2026] [security2:error] [pid 21750:tid 21831] [cli ...
show more
(mod_security) mod_security (id:217200) triggered by 217.76.48.52 (vmi3672677.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 01:53:51.816306 2026] [security2:error] [pid 21750:tid 21831] [client 217.76.48.52:9432] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||cpanel.abadie.com.uy:443|F|2"] [data "/guest_auth/guestisup.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "cpanel.abadie.com.uy"] [uri "/guest_auth/guestIsUp.php"] [unique_id "auLfb0ipiKVxjD5jUB5qHwAAAdg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
