🇺🇸
TPI-Abuse
2026-10-15 14:59:11
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:59:05.593814 2026] [security2:error] [pid 22940:tid 22968] [client 39.106.150.117:48048] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aaenroll.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aaenroll.com"] [uri "/okok.cer"] [unique_id "atDqOSvSn2sHp4F9Mb1EdAAAAJA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-10-14 22:51:21
(1 day ago)
[redacted] 39.106.150.117 - - [14/Oct/2026:23:51:11 +0100] "GET /[redacted] HTTP/2.0" 301 173 "https ...
show more
[redacted] 39.106.150.117 - - [14/Oct/2026:23:51:11 +0100] "GET /[redacted] HTTP/2.0" 301 173 "https://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" [redacted] 39.106.150.117 - - [14/Oct/2026:23:51:14 +0100] "GET /fr/[redacted]/ HTTP/2.0" 404 34946 "https://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-10-14 15:25:23
(2 days ago)
[redacted] 39.106.150.117 - - [14/Oct/2026:16:25:18 +0100] "GET /[redacted] HTTP/2.0" 301 173 "http: ...
show more
[redacted] 39.106.150.117 - - [14/Oct/2026:16:25:18 +0100] "GET /[redacted] HTTP/2.0" 301 173 "http://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" [redacted] 39.106.150.117 - - [14/Oct/2026:16:25:19 +0100] "GET /fr/[redacted]/ HTTP/2.0" 404 35095 "https://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-10-14 08:42:12
(2 days ago)
[redacted] 39.106.150.117 - - [14/Oct/2026:09:41:50 +0100] "GET /[redacted] HTTP/2.0" 301 174 "https ...
show more
[redacted] 39.106.150.117 - - [14/Oct/2026:09:41:50 +0100] "GET /[redacted] HTTP/2.0" 301 174 "https://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" [redacted] 39.106.150.117 - - [14/Oct/2026:09:41:57 +0100] "GET /fr/[redacted]/ HTTP/2.0" 404 35099 "https://[redacted]/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-10 08:40:07
(6 days ago)
Multiple WAF Violations
Web App Attack
🇬🇧
consul.to
2026-10-09 10:00:51
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 11:47:10
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 07:47:06.465950 2026] [security2:error] [pid 11338:tid 11338] [client 39.106.150.117:38004] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tell-me-first.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tell-me-first.com"] [uri "/okok.cer"] [unique_id "aseCuv4Y-cJqQgIS-V4hGwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 00:01:56
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 20:01:50.417084 2026] [security2:error] [pid 12741:tid 12750] [client 39.106.150.117:47140] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||seips.org|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "seips.org"] [uri "/okok.cer"] [unique_id "asbdbi1rnGYqPmSuxj-smAAAAUM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
madaello
2026-10-07 15:03:08
(1 week ago)
39.106.150.117 - - [07/Oct/2026:17:03:05 +0200] "GET /README.md HTTP/1.1" 404 505 "-" "Mozilla/5.0 ( ...
show more
39.106.150.117 - - [07/Oct/2026:17:03:05 +0200] "GET /README.md HTTP/1.1" 404 505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
39.106.150.117 - - [07/Oct/2026:17:03:07 +0200] "GET /includes/cls_sms.php HTTP/1.1" 404 505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
39.106.150.117 - - [07/Oct/2026:17:03:07 +0200] "GET /api/goods.php HTTP/1.1" 404 505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
39.106.150.117 - - [07/Oct/2026:17:03:07 +0200] "GET /static/warn/close.php HTTP/1.1" 404 505 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
39.106.150.117 - - [07/Oct/2026:17:03:08 +0200] "GET /d/txt/test.txt HTTP/1.1" 404 4449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Port Scan
🇬🇧
consul.to
2026-10-07 02:06:16
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-05 19:18:56
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-10-05 12:00:00
(1 week ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
Zhengka.net
2026-10-03 16:10:56
(1 week ago)
zhengka.net security honeypot hit; jail=zhengka.net_honeypot; ip=39.106.150.117
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 03:42:43
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 23:42:39.278940 2026] [security2:error] [pid 24367:tid 24367] [client 39.106.150.117:36926] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.jimhermelband.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.jimhermelband.com"] [uri "/okok.cer"] [unique_id "asB5r1PBN1T69fIjXkxIjgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 03:55:26
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 39.106.150.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 23:55:22.461515 2026] [security2:error] [pid 15770:tid 15770] [client 39.106.150.117:60182] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.atelier92.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.atelier92.com"] [uri "/okok.cer"] [unique_id "ar8rKqOve4ugV4KKt7W84wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack