🇺🇸
JustMeHere
2026-10-06 19:39:31
(1 day ago)
[Tue Oct 06 15:39:22.936994 2026] [security2:error] [pid 1249:tid 1279] [client 45.61.185.19:55524] ...
show more
[Tue Oct 06 15:39:22.936994 2026] [security2:error] [pid 1249:tid 1279] [client 45.61.185.19:55524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "freepbx.yorknation.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asVOapGlSUsbYuhhFIDkxAAAAMI"]
...
show less
Web App Attack
🇪🇸
el-brujo
2026-10-06 04:14:10
(1 day ago)
06/Oct/2026:06:14:09.355961 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
06/Oct/2026:06:14:09.355961 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 45.61.185.19] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".cfg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ns2.elhacker.net"] [uri "/sip-ps/0004f2000000-sip.c
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 03:59:51
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 23:59:47.655813 2026] [security2:error] [pid 3077:tid 3077] [client 45.61.185.19:61032] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||providencetheband.com.imagesbyaubrey.com|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "providencetheband.com.imagesbyaubrey.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asRyM8DmQ1CUQOLQV2xp2gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 01:12:36
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 21:12:31.908448 2026] [security2:error] [pid 4895:tid 4895] [client 45.61.185.19:59069] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||providencesilverco.com|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "providencesilverco.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asRK_4bYf_F1RrvoXDud9gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 21:04:08
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2002:2d3d:b913::2d3d:b913 (Unknown): 1 in the l ...
show more
(mod_security) mod_security (id:210730) triggered by 2002:2d3d:b913::2d3d:b913 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 17:04:00.254513 2026] [security2:error] [pid 893673:tid 893699] [client 2002:2d3d:b913::2d3d:b913:53657] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||providencetheological.com|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "providencetheological.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asQQwGZBYIIkK9OfjrIaLAAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
JustMeHere
2026-10-05 18:02:30
(2 days ago)
[Mon Oct 05 14:02:22.025065 2026] [security2:error] [pid 822:tid 971] [client 45.61.185.19:53586] Mo ...
show more
[Mon Oct 05 14:02:22.025065 2026] [security2:error] [pid 822:tid 971] [client 45.61.185.19:53586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "gateway.yorknation.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asPmLh8WQOVArlWRERBSEQAAAJA"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 17:31:17
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 13:31:10.227149 2026] [security2:error] [pid 582164:tid 582176] [client 45.61.185.19:55150] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||providencetheological.net|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "providencetheological.net"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asPe3g4mOwXhgHpQ9j6PWQAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
JustMeHere
2026-10-05 15:55:37
(2 days ago)
[Mon Oct 05 11:55:33.455946 2026] [security2:error] [pid 1249:tid 1277] [client 45.61.185.19:57564] ...
show more
[Mon Oct 05 11:55:33.455946 2026] [security2:error] [pid 1249:tid 1277] [client 45.61.185.19:57564] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "yorknation.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asPIdZGlSUsbYuhhFIC1YwAAAMA"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 15:32:22
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:32:15.488992 2026] [security2:error] [pid 10464:tid 10464] [client 45.61.185.19:64114] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||proventransmission.com|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "proventransmission.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asPC__tz8H6XrlaZRA5cngAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
hostsec_za
2026-10-05 11:37:01
(2 days ago)
cPanel/WHM/cPDAVd/Webmail Auth Attack. 21 failed logins in 1 hour.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-05 10:53:42
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 45.61.185.19 (exitrelay46.medvideos-tor.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 06:53:34.773644 2026] [security2:error] [pid 7057:tid 7057] [client 45.61.185.19:52632] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||ardeeapps.com|F|2"] [data ".cfg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ardeeapps.com"] [uri "/sip-ps/0004f2000000-sip.cfg"] [unique_id "asOBrsMBKbrvWEK3PZnLZwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
velenobbs.net
2023-04-05 02:03:17
(3 years ago)
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= ui ...
show more
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.185.19 user=root
Jan 15 07:54:23 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
Jan 15 07:54:26 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
show less
Brute-Force
SSH
🇩🇪
velenobbs.net
2023-02-07 01:19:04
(3 years ago)
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= ui ...
show more
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.185.19 user=root
Jan 15 07:54:23 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
Jan 15 07:54:26 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
show less
Brute-Force
SSH
🇩🇪
velenobbs.net
2023-01-18 00:14:31
(3 years ago)
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= ui ...
show more
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.185.19 user=root
Jan 15 07:54:23 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
Jan 15 07:54:26 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
show less
Brute-Force
SSH
🇩🇪
velenobbs.net
2022-11-17 21:08:13
(3 years ago)
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= ui ...
show more
Jan 15 07:54:21 vmi263387 sshd\[28390\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.185.19 user=root
Jan 15 07:54:23 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
Jan 15 07:54:26 vmi263387 sshd\[28390\]: Failed password for root from 45.61.185.19 port 47832 ssh2
show less
Brute-Force
SSH
