🇩🇪
rh24
2026-06-13 23:13:16
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 38.225.15.117 (SE/Sw ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 38.225.15.117 (SE/Sweden/-)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-01 03:06:01
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 23:05:57.622614 2026] [security2:error] [pid 7732:tid 7770] [client 38.225.15.117:57501] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.staging.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.staging.kettlehill.com"] [uri "/error/error.log"] [unique_id "ahz3FSKq_i-FrRbJEDISgwAAAVg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 21:35:07
(3 months ago)
(mod_security) mod_security (id:212620) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 17:34:56.129107 2026] [security2:error] [pid 166087:tid 166087] [client 38.225.15.117:35589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||mail.nbcnewsradio.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /error?msg=</script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "mail.nbcnewsradio.com"] [uri "/error"] [unique_id "adbKAAM4RcCDgGbGo0mbfAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Roderic
2026-03-28 14:05:58
(3 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-01 12:03:07
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 07:03:02.838110 2026] [security2:error] [pid 483:tid 661] [client 38.225.15.117:52621] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kettlehill.net"] [uri "/a.htaccess"] [unique_id "aX9A9gMxl-cQ0UzvOvSS1AAAAE8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 15:44:23
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 10:44:18.439258 2026] [security2:error] [pid 25583:tid 25583] [client 38.225.15.117:34261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.nbcnewsradio.com"] [uri "/sftp-config.json"] [unique_id "aWpc0moLWGB3lAjtbcWJfQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-29 13:02:24
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 09:02:19.114285 2025] [security2:error] [pid 22566:tid 22566] [client 38.225.15.117:41983] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.davispickering.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.davispickering.com"] [uri "/www.key"] [unique_id "aQIQW_U3xWB6HkC4NPG4sAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-28 22:04:54
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 28 18:04:46.422961 2025] [security2:error] [pid 17826:tid 17826] [client 38.225.15.117:42953] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nbcnewsradio.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nbcnewsradio.com"] [uri "/wp-login.php.bak"] [unique_id "aQE9_urWzVYHtx05qSPSNwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 15:43:25
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 11:43:17.025082 2025] [security2:error] [pid 30110:tid 30160] [client 38.225.15.117:53463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.kettlehill.net"] [uri "/.env.dev"] [unique_id "aN1MFckWrLLgoGKIU58jAQAAAc8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2025-08-29 03:40:04
(10 months ago)
IP was involved in L7 DDoS attack.
DDoS Attack
🇸🇬
raramos
2025-08-07 19:00:07
(11 months ago)
[SMB remote code execution attempt: port tcp/445]
in blocklist.de:'listed [pop3]'
in SpamCop:'listed ...
show more
[SMB remote code execution attempt: port tcp/445]
in blocklist.de:'listed [pop3]'
in SpamCop:'listed'
in sorbs:'listed [web], [spam]'
in Unsubscore:'listed'
*(RWIN=8192)(04:10)
show less
Web Spam
Email Spam
Port Scan
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 07:37:31
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 03:37:23.749790 2025] [security2:error] [pid 3705323:tid 3705340] [client 38.225.15.117:32801] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.kettlehill.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.kettlehill.net"] [uri "/index.php.bak"] [unique_id "aIxus1SqWoxQtnj67bcUrQAAAEE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-02 00:31:05
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 20:30:57.299483 2025] [security2:error] [pid 3451437:tid 3451437] [client 38.225.15.117:48001] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/admin/logs/errors.log"] [unique_id "aDzwwRnMWQVaEqsLpN9RqgAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 05:29:18
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 01:27:47.512002 2025] [security2:error] [pid 2256136:tid 2256220] [client 38.225.15.117:47299] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.com"] [uri "/wp-content/plugins/simple-file-list/includes/ee-downloader.php"] [unique_id "aDvk07VUnYIqO9hNDISuSAAAAJA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-28 20:12:16
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 38.225.15.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 28 16:12:08.274738 2025] [security2:error] [pid 1841644:tid 1841644] [client 38.225.15.117:37415] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.farmers123.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.farmers123.com"] [uri "/footer.php.bak"] [unique_id "aDduGE5Grl5WewjCVZuISwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack