🇺🇸
TPI-Abuse
2025-12-29 17:27:54
(5 months ago)
(mod_security) mod_security (id:221260) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:27:01.038487 2025] [security2:error] [pid 27855:tid 28182] [client 45.61.127.68:40797] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.net"] [uri "/cgi-bin/status"] [unique_id "aVK55a0TyVBQ9TgqIEW5NwAAARA"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
[email protected]
2025-12-29 10:11:12
(5 months ago)
Attack attempt against Interwebbi servers; *Port Scan* detected from 45.61.127.68 (US/United States/ ...
show more
Attack attempt against Interwebbi servers; *Port Scan* detected from 45.61.127.68 (US/United States/-). 5 hits in the last 45 seconds; IP: 45.61.127.68; Ports: *; Direction: 0; Trigger: PS_LIMIT;
show less
Brute-Force
🇺🇸
TPI-Abuse
2025-11-13 10:01:59
(6 months ago)
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 05:01:54.492152 2025] [security2:error] [pid 9939:tid 9939] [client 45.61.127.68:48531] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/index.html?id=%24%7B%40print_r%28%40system%28%22cat+/etc/passwd%22%29%29%7D"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/images/index.html"] [unique_id "aRWskiQTzkk-VNg37Q6hUgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nowyouknow
2025-09-22 21:38:47
(8 months ago)
(From [email protected] ) Hi,
Are you interested in purchasing the Money 20/20 USA ...
show more
(From [email protected] ) Hi,
Are you interested in purchasing the Money 20/20 USA attendees contacts for your business outreach?
Event Name: Money 20/20 USA
Counts : 12,000 attendees contacts
If you’re interested, please reply to this email or contact me at [email protected] . I’ll share the pricing details for your review.
Thanks
Ruby
PS - Please reply "No" if you wish to opt-out from our mails.
show less
Phishing
Web Spam
🇺🇸
TPI-Abuse
2025-08-31 04:16:40
(9 months ago)
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 00:16:34.057874 2025] [security2:error] [pid 2797787:tid 2797807] [client 45.61.127.68:48443] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.kettlehill.net|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/index.php"] [unique_id "aLPMovC0t62R7dFmgHglGgAAARA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-09-03 18:45:58
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:45:40.466752 2024] [security2:error] [pid 25047:tid 25047] [client 45.61.127.68:45691] [client 45.61.127.68] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.stdavids-media.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.stdavids-media.com"] [uri "/localhost.sql"] [unique_id "ZtdZVGAzgBdRYO8ZcO3dEQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-08-22 13:07:12
(1 year ago)
45.61.127.68 - - [22/Aug/2024:15:07:11 +0200] "GET /_s_/dyn/Log_highlight?href=../../../../../../../ ...
show more
45.61.127.68 - - [22/Aug/2024:15:07:11 +0200] "GET /_s_/dyn/Log_highlight?href=../../../../../../../../../windows/win.ini&n=1 HTTP/1.1" 404 63218 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" 93395
...
show less
Hacking
🇺🇸
TPI-Abuse
2024-07-27 20:18:22
(1 year ago)
(mod_security) mod_security (id:221260) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 27 16:17:05.325410 2024] [security2:error] [pid 22440:tid 22473] [client 45.61.127.68:35115] [client 45.61.127.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||webmail.staging.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.staging.kettlehill.com"] [uri "/debug.cgi"] [unique_id "ZqVVwRUtUDUbeeZ7GhUSGgAAAAU"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ps-center
2024-07-16 00:44:50
(1 year ago)
SS1: Web Attack GET /Admin/Admin.aspx
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-06-28 03:12:29
(1 year ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇺🇸
TPI-Abuse
2024-05-15 01:49:43
(2 years ago)
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:211190) triggered by 45.61.127.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 14 21:49:33.129873 2024] [security2:error] [pid 20072:tid 47952281982720] [client 45.61.127.68:60109] [client 45.61.127.68] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||staging.kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staging.kettlehill.com"] [uri "/server/node_upgrade_srv.js"] [unique_id "ZkQUrZM3wD4Fbah2IMwvFwAAAcw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-05-08 07:00:43
(2 years ago)
Unauthorized login attempts []
Brute-Force
🇪🇸
10dencehispahard SL
2024-05-08 07:00:23
(2 years ago)
Web Attack
DDoS Attack
Brute-Force
Web App Attack
🇪🇸
10dencehispahard SL
2024-03-27 07:00:25
(2 years ago)
Unauthorized login attempts [ BI-16635]
Brute-Force
🇪🇸
10dencehispahard SL
2024-03-27 06:54:16
(2 years ago)
WP scan
Web App Attack