🇺🇸
TPI-Abuse
2025-12-05 20:43:39
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 15:43:35.657437 2025] [security2:error] [pid 9362:tid 9362] [client 2a0b:f4c2::23:46660] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||sandiegoautostarsmog.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sandiegoautostarsmog.com"] [uri "/starsmog.sql"] [unique_id "aTND9-x8CYpbj_-JG4Yd-QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 19:52:27
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 14:52:18.637194 2025] [security2:error] [pid 26958:tid 26958] [client 2a0b:f4c2::23:33432] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tttns.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tttns.com"] [uri "/tns_com.sql"] [unique_id "aTM38jw-bajUri5BONdQugAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 02:31:13
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 21:31:07.977563 2025] [security2:error] [pid 17480:tid 17480] [client 2a0b:f4c2::23:15946] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||metcomarine.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "metcomarine.com"] [uri "/metcomar.sql"] [unique_id "aTJD6xEUxLe5fZybC7Xw3wAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 01:19:50
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 20:19:41.726372 2025] [security2:error] [pid 8988:tid 8994] [client 2a0b:f4c2::23:10616] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||koalacogs.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "koalacogs.com"] [uri "/koal.sql"] [unique_id "aTIzLSsHoi9herde8U5g_AAAAIQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-04 19:17:35
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 14:17:27.886310 2025] [security2:error] [pid 32509:tid 32509] [client 2a0b:f4c2::23:38024] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||kenometer.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kenometer.com"] [uri "/daily.sql"] [unique_id "aTHeR_QKlAfbR4g7qFQZggAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 21:39:37
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:39:32.472414 2025] [security2:error] [pid 5291:tid 5291] [client 2a0b:f4c2::23:5048] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coolcustomproducts.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coolcustomproducts.com"] [uri "/back.sql"] [unique_id "aSjFFFbzgSXLODcg3wy6EQAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-20 10:10:08
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 20 05:09:56.865296 2025] [security2:error] [pid 25910:tid 25910] [client 2a0b:f4c2::23:54702] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kinderland-preschool.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kinderland-preschool.com"] [uri "/and-preschool.sql"] [unique_id "aR7o9Ggo5EfNEHf6B0u2vQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-19 07:49:39
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 19 02:49:31.537694 2025] [security2:error] [pid 12411:tid 12411] [client 2a0b:f4c2::23:5390] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.tgdingenieria.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.tgdingenieria.com"] [uri "/.sql"] [unique_id "aR12izGV_bfeT4E5lu00rAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-17 01:35:12
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 16 20:35:06.101144 2025] [security2:error] [pid 9920:tid 9920] [client 2a0b:f4c2::23:59730] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thenursingsite.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thenursingsite.com"] [uri "/backup_wp.sql"] [unique_id "aRp7ym6tfAnMK-J1CeojwQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-12 20:33:40
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 15:33:36.021279 2025] [security2:error] [pid 9081:tid 9087] [client 2a0b:f4c2::23:11910] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kemalinal.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kemalinal.com"] [uri "/l.sql"] [unique_id "aRTvIA9ixfBdsSfJcgkUMwAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
weblite
2025-11-11 01:56:20
(10 months ago)
WP_MALWARE_PROBE
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-11-10 09:08:27
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 10 04:08:20.951050 2025] [security2:error] [pid 10225:tid 10225] [client 2a0b:f4c2::23:5810] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||garantaconsulting.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "garantaconsulting.com"] [uri "/garantacons.sql"] [unique_id "aRGrhGgFyXlr-8lC4v-vUQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-09 00:40:41
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 08 19:40:34.511394 2025] [security2:error] [pid 9026:tid 9026] [client 2a0b:f4c2::23:49060] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||my-pitch.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "my-pitch.org"] [uri "/backups.sql"] [unique_id "aQ_jAg3q67DLN7_P_jLYkgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
london2038.com
2025-11-05 08:51:36
(11 months ago)
Probing for exploits
2a0b:f4c2::23 - - [05/Nov/2025:09:51:30 +0100] "GET /london203.sql HTTP/1.1" 30 ...
show more
Probing for exploits
2a0b:f4c2::23 - - [05/Nov/2025:09:51:30 +0100] "GET /london203.sql HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.0"
2a0b:f4c2::23 - - [05/Nov/2025:09:51:31 +0100] "GET /londo.sql HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.0"
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-11-04 14:33:23
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::23 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 04 09:33:17.487036 2025] [security2:error] [pid 13189:tid 13236] [client 2a0b:f4c2::23:44278] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jaslae.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jaslae.com"] [uri "/.sql"] [unique_id "aQoOrYj_NOZTxveHykz4sQAAAVI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
