🇺🇸
TPI-Abuse
2026-10-15 04:07:15
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 00:07:10.598374 2026] [security2:error] [pid 15395:tid 15404] [client 240e:d9:c200:105:b578::400:49728] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||a.my-drug-store.kylight.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "a.my-drug-store.kylight.com"] [uri "/okok.cer"] [unique_id "atBRbr6RQOVQ1G1OFkeT8AAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-10 22:18:49
(1 week ago)
Brute-Force
Web App Attack
🇩🇪
macrob
2026-10-10 18:28:27
(1 week ago)
2026/10/10 18:28:23 [error] 2003441#2003441: *37797346 access forbidden by rule, client: 240e:d9:c20 ...
show more
2026/10/10 18:28:23 [error] 2003441#2003441: *37797346 access forbidden by rule, client: 240e:d9:c200:105:b578::400, server: 100fs.org, request: "GET /d/txt/test.txt HTTP/1.1", host: "100fs.org"
2026/10/10 18:28:25 [error] 2003440#2003440: *37797392 access forbidden by rule, client: 240e:d9:c200:105:b578::400, server: 100fs.org, request: "GET /admin/plugin/uploadify/btn.gif HTTP/1.1", host: "100fs.org"
2026/10/10 18:28:25 [error] 2003441#2003441: *37797390 access forbidden by rule, client: 240e:d9:c200:105:b578::400, server: 100fs.org, request: "GET /adminsoft/index.php?archive=adminuser&action=login HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 07:14:31
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 03:14:24.937748 2026] [security2:error] [pid 23207:tid 23207] [client 240e:d9:c200:105:b578::400:50334] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.primelb.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.primelb.com"] [uri "/okok.cer"] [unique_id "asnl0HANnKQiBC8IeiIFzAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-05 23:02:55
(2 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇲🇾
Rizzy
2026-10-05 17:37:32
(2 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
LRob
2026-10-05 14:22:35
(2 weeks ago)
Web page flood (L7) | path: /huyaa.php, /fun.php, /996633.php (+17 more) | 2026-10-05 14:22 UTC
DDoS Attack
Web App Attack
🇦🇺
iBlockBadBots
2026-10-04 10:00:10
(2 weeks ago)
WAF blocked multiple times in 24h. Paths: /; /public/images/metinfo.gif; /README.md; /e/DownSys/play ...
show more
WAF blocked multiple times in 24h. Paths: /; /public/images/metinfo.gif; /README.md; /e/DownSys/play/images/top_l.gif; /app/img/loading.gif
show less
Bad Web Bot
Web App Attack
🇫🇷
regishoussin
2026-10-03 06:03:38
(2 weeks ago)
Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of ...
show more
Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-03 06:03 UTC.
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 02:29:35
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 22:29:30.168983 2026] [security2:error] [pid 501:tid 513] [client 240e:d9:c200:105:b578::400:51752] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.idwic.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.idwic.com"] [uri "/okok.cer"] [unique_id "asBoio26BvzPv41sNDU_pAAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 09:41:07
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:40:59.651665 2026] [security2:error] [pid 8017:tid 8114] [client 240e:d9:c200:105:b578::400:35688] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.broadmoordermatology.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.broadmoordermatology.com"] [uri "/okok.cer"] [unique_id "ar98K9POw3CT_GbXpowJbQAAAYI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 09:10:44
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:10:37.920792 2026] [security2:error] [pid 1137:tid 1137] [client 240e:d9:c200:105:b578::400:38080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bonvivantorganics.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bonvivantorganics.com"] [uri "/okok.cer"] [unique_id "ar91DX3zzvqQWkQghrz6bAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-29 21:00:05
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 20:22:40
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 16:22:34.349072 2026] [security2:error] [pid 24063:tid 24063] [client 240e:d9:c200:105:b578::400:33980] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||sawtoothstudios.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sawtoothstudios.com"] [uri "/okok.cer"] [unique_id "arweCpPwiMN9i6E-WMCzXgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 09:35:41
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the ...
show more
(mod_security) mod_security (id:210730) triggered by 240e:d9:c200:105:b578::400 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 05:35:37.012006 2026] [security2:error] [pid 29103:tid 29103] [client 240e:d9:c200:105:b578::400:50384] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pro-fitinvestment.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pro-fitinvestment.com"] [uri "/okok.cer"] [unique_id "aruGaXOPUhjNeSrCcbhOZQAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
