🇩🇪
EGP Abuse Dept
2026-06-02 06:30:48
(3 days ago)
Scanning for web/db/file exploits on tpc-001.mach3builders.nl
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 02:47:44
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 22:47:37.485438 2026] [security2:error] [pid 7571:tid 7605] [client 45.41.171.55:51017] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.com"] [uri "/errors/errors.log"] [unique_id "ahzyyQB9GwiQ72im4TcuWAAAAEo"], referer: http://www.kettlehill.com/errors/errors.log
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 16:33:32
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 11:33:24.554313 2026] [security2:error] [pid 9373:tid 9373] [client 45.41.171.55:32907] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/.env.nbcnewsradio"] [unique_id "aWpoVGSoUCOBA9B6wCUJFAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 23:39:55
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 18:39:51.838854 2025] [security2:error] [pid 2959:tid 2959] [client 45.41.171.55:34369] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.farmers123.com"] [uri "/.env.production"] [unique_id "aS94x23upS1RbSAEf13r8wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-01 05:59:11
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 00:59:04.611613 2025] [security2:error] [pid 25970:tid 26015] [client 45.41.171.55:47119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.kettlehill.com"] [uri "/log.log"] [unique_id "aS0uqJmi-m8ypGFmmHe-mwAAAUI"], referer: http://mail.kettlehill.com/log.log
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
Erpelstolz
2025-11-25 11:24:28
(6 months ago)
VM 131: 45.41.171.55 - - [25/Nov/2025:12:24:22 +0100] "GET /partymgr/control/getJSONuiLabel HTTP/1.1 ...
show more
VM 131: 45.41.171.55 - - [25/Nov/2025:12:24:22 +0100] "GET /partymgr/control/getJSONuiLabel HTTP/1.1" 301 753
show less
Web App Attack
2025-11-18 14:40:04
(6 months ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
Moby
2025-11-01 20:37:37
(7 months ago)
Sat Nov 01 15:31:23.246020 202545.41.171.55 - - [01/Nov/2025:15:31:32 -0500] "GET /i.php HTTP/1.1" 4 ...
show more
Sat Nov 01 15:31:23.246020 202545.41.171.55 - - [01/Nov/2025:15:31:32 -0500] "GET /i.php HTTP/1.1" 404 984 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
45.41.171.55 - - [01/Nov/2025:15:36:02 -0500] "GET /etc/passwd HTTP/1.1" 404 984 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
45.41.171.55 - - [01/Nov/2025:15:36:10 -0500] "GET /.../.../.../.../.../.../.../.../.../windows/win.ini HTTP/1.1" 404 984 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-10-28 23:18:42
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 28 19:18:36.024309 2025] [security2:error] [pid 31258:tid 31258] [client 45.41.171.55:52725] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nbcnewsradio.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nbcnewsradio.com"] [uri "/elmah.axd"] [unique_id "aQFPTImJEY1pkZqXCZkaRQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 15:22:43
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210730) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 11:22:39.068468 2025] [security2:error] [pid 31612:tid 31746] [client 45.41.171.55:38309] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.kettlehill.net"] [uri "/php_errors.log"] [unique_id "aN1HP_VYIT9TWn2lWzKCgAAAARM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-22 21:34:23
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream ...
show more
(mod_security) mod_security (id:210492) triggered by 45.41.171.55 (ip-45-41-171-55.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 22 17:34:18.069698 2025] [security2:error] [pid 861:tid 861] [client 45.41.171.55:40903] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.deandobkin.com"] [uri "/.env.www"] [unique_id "aNHA2nfn_pA_7ApiJu9R8AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-28 03:50:14
(10 months ago)
wordpress-trap
Web App Attack