🇺🇸
TPI-Abuse
2024-03-28 18:29:58
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 14:29:51.586243 2024] [security2:error] [pid 3985] [client 52.179.102.163:2829] [client 52. ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 14:29:51.586243 2024] [security2:error] [pid 3985] [client 52.179.102.163:2829] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.tradersworldmarket.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.tradersworldmarket.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgW3H_2Vi28i3deO-5z-dgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 18:08:18
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 14:08:13.856899 2024] [security2:error] [pid 11167] [client 52.179.102.163:2578] [client 52 ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 14:08:13.856899 2024] [security2:error] [pid 11167] [client 52.179.102.163:2578] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.marjorierosenberg.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.marjorierosenberg.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgWyDWZ-KHUXM8cc6leCmgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
Birdflew
2024-03-28 18:02:54
UTC ·
(2 years ago)
Port scanning
Hacking
🇲🇾
Rizzy
2024-03-28 17:25:39
UTC ·
(2 years ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 17:22:53
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 13:22:48.829999 2024] [security2:error] [pid 2414] [client 52.179.102.163:3603] [client 52. ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 13:22:48.829999 2024] [security2:error] [pid 2414] [client 52.179.102.163:3603] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.iclog.us|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.iclog.us"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgWnaH7XPheLdNdKAnjvDgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 16:30:42
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 12:30:37.320939 2024] [security2:error] [pid 28018] [client 52.179.102.163:2437] [client 52 ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 12:30:37.320939 2024] [security2:error] [pid 28018] [client 52.179.102.163:2437] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||powerfulpals.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "powerfulpals.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgWbLTH7gIQcIz-qFzQUVgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 14:59:07
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 10:59:03.985051 2024] [security2:error] [pid 2489] [client 52.179.102.163:3458] [client 52. ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 10:59:03.985051 2024] [security2:error] [pid 2489] [client 52.179.102.163:3458] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||deliverystations.co|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "deliverystations.co"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgWFt4fehViPEOORn1D0KQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2024-03-28 14:41:36
UTC ·
(2 years ago)
52.179.102.163 - - [28/Mar/2024:16:41:35 +0200] "GET /wp-admin/css/colors/blue/CasperExV1.php HTTP/1.1" 404 274 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0"
...
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 14:29:12
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 10:29:04.803744 2024] [security2:error] [pid 11051] [client 52.179.102.163:3806] [client 52 ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 10:29:04.803744 2024] [security2:error] [pid 11051] [client 52.179.102.163:3806] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.integrabroadcast.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.integrabroadcast.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgV-sFsHg1eQRiNVU4bJ5AAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2024-03-28 13:42:00
UTC ·
(2 years ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.179.102.163 (US/United States/-)
Port Scan
🇺🇸
TPI-Abuse
2024-03-28 13:26:19
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 09:26:14.619491 2024] [security2:error] [pid 25338] [client 52.179.102.163:2633] [client 52 ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 09:26:14.619491 2024] [security2:error] [pid 25338] [client 52.179.102.163:2633] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||miroconsulting.es|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "miroconsulting.es"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgVv9rM3Q3U0BN3CN3EyBwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-03-28 13:11:46
UTC ·
(2 years ago)
Ports: 20,21,25,53,80,110,143,443,465,587,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,3306,2195; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇦
URAN Publishing Service
2024-03-28 12:59:37
UTC ·
(2 years ago)
52.179.102.163 - - [28/Mar/2024:14:59:36 +0200] "GET /wp-admin/css/colors/blue/CasperExV1.php HTTP/1.1" 404 275 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"
52.179.102.163 - ...
show more
52.179.102.163 - - [28/Mar/2024:14:59:36 +0200] "GET /wp-admin/css/colors/blue/CasperExV1.php HTTP/1.1" 404 275 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"
52.179.102.163 - - [28/Mar/2024:14:59:37 +0200] "GET /wp-content/index.php HTTP/1.1" 404 275 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2024-03-28 12:59:31
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 08:59:24.526086 2024] [security2:error] [pid 31654] [client 52.179.102.163:2102] [client 52 ...
show more
(mod_security) mod_security (id:210730) triggered by 52.179.102.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 08:59:24.526086 2024] [security2:error] [pid 31654] [client 52.179.102.163:2102] [client 52.179.102.163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.radionicships.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.radionicships.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZgVprOTDAXwFavVXRemUoQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-03-28 12:35:53
UTC ·
(2 years ago)
Ports: *; Direction: 0; Trigger: CT_LIMIT
Brute-Force
SSH