🇺🇸
TPI-Abuse
2026-06-26 23:54:00
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 19:53:45.378546 2026] [security2:error] [pid 4049:tid 4049] [client 60.5.26.28:60893] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cynosuresnapshots.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cynosuresnapshots.com"] [uri "/"] [unique_id "aj8RCbjHzA0ATkrZy3zP7wAAAA0"], referer: http://cynosuresnapshots.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 19:10:40
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 15:10:24.929553 2026] [security2:error] [pid 5374:tid 5374] [client 60.5.26.28:34356] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.walkerweb.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.walkerweb.com"] [uri "/"] [unique_id "aj7OoPQJXFcSp5kug2YrpAAAABo"], referer: http://www.walkerweb.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 21:15:43
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 17:15:30.095746 2026] [security2:error] [pid 10069:tid 10069] [client 60.5.26.28:44041] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||learningbyshipping.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "learningbyshipping.com"] [uri "/"] [unique_id "ajr3crdZAE3fV_lza259RgAAAA4"], referer: https://learningbyshipping.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-13 23:50:48
(2 weeks ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 19:50:31.442265 2026] [security2:error] [pid 17187:tid 17187] [client 60.5.26.28:36792] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.al-harbi.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.al-harbi.com"] [uri "/"] [unique_id "ai3sxzWDLRIkXD9dhV43LwAAAAU"], referer: http://www.al-harbi.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-12 23:39:04
(2 weeks ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 19:38:50.988578 2026] [security2:error] [pid 7786:tid 7786] [client 60.5.26.28:35131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.floorswedo.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.floorswedo.com"] [uri "/"] [unique_id "aiyYisce_T8-JHTIY8Bw5AAAACI"], referer: http://www.floorswedo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 20:00:10
(3 weeks ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 15:59:52.379436 2026] [security2:error] [pid 31212:tid 31212] [client 60.5.26.28:14416] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||tcmu.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "tcmu.org"] [uri "/index.html"] [unique_id "ah3kuOl2v5Pf2Y0zSPo64wAAAB8"], referer: http://tcmu.org/index.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 22:11:37
(3 months ago)
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 60.5.26.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 18:11:23.560521 2026] [security2:error] [pid 22208:tid 22208] [client 60.5.26.28:47154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||verenacastle.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "verenacastle.com"] [uri "/"] [unique_id "ab8Xi2UUhxN31WYKLH_MEQAAABE"], referer: https://verenacastle.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇳
ThreatBook.io
2025-10-04 23:20:40
(8 months ago)
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-10-04 08 ...
show more
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-10-04 08:59:17 /
show less
Web App Attack
🇨🇳
ThreatBook.io
2025-08-29 23:17:25
(9 months ago)
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-08-29 20 ...
show more
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-08-29 20:40:59 /
show less
Web App Attack
🇨🇳
ThreatBook.io
2025-07-23 23:34:07
(11 months ago)
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-07-23 06 ...
show more
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-07-23 06:34:35 /config.json
show less
Web App Attack
🇨🇳
ThreatBook.io
2025-07-07 00:31:40
(11 months ago)
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-07-06 04 ...
show more
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/60.5.26.28
2025-07-06 04:44:17 /
show less
Web App Attack