🇨🇳
ThreatBook.io
2026-01-13 00:11:45
UTC ·
(10 months ago)
2026-01-12 08:53:31 /assets/favicon-7901bd695fb93edb07975966062049829afb56cf11511236e61bcf425070e36e.png
2026-01-12 08:53:31 /
Web App Attack
🇺🇸
TPI-Abuse
2025-12-10 16:30:04
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 11:29:56.194674 2025] [security2:error] [pid 21462:tid 21469] [client 64.227.162.39:51452] M ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 11:29:56.194674 2025] [security2:error] [pid 21462:tid 21469] [client 64.227.162.39:51452] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perspectivedesigninc.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perspectivedesigninc.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTmgBCggYD6TiBMItQgTKAAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-10 13:41:03
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 08:40:57.784342 2025] [security2:error] [pid 491:tid 491] [client 64.227.162.39:51590] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 08:40:57.784342 2025] [security2:error] [pid 491:tid 491] [client 64.227.162.39:51590] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aksaltwatercharters.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aksaltwatercharters.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTl4aRgRcqHvCs-0ZTwkewAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2025-12-10 13:13:43
UTC ·
(11 months ago)
Triggered Cloudflare WAF (firewallCustom) from IN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //vendor/phpunit/phpunit/phpunit.xsd
UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
This report was generated ...
show more
Triggered Cloudflare WAF (firewallCustom) from IN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: //vendor/phpunit/phpunit/phpunit.xsd
UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-10 13:00:00
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:59:56.616577 2025] [security2:error] [pid 2577:tid 2577] [client 64.227.162.39:0] ModSecu ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:59:56.616577 2025] [security2:error] [pid 2577:tid 2577] [client 64.227.162.39:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uwsvita.org|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uwsvita.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTluzHb43f6-1kRFG6RtuwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-10 12:08:41
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:08:37.739462 2025] [security2:error] [pid 2592:tid 2592] [client 64.227.162.39:0] ModSecu ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:08:37.739462 2025] [security2:error] [pid 2592:tid 2592] [client 64.227.162.39:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aslanhan.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aslanhan.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTlixS2lEjjGAdLgUz3yOAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
6o6ep
2025-12-10 08:52:35
UTC ·
(11 months ago)
PHPUnit trap
Port Scan
Hacking
Web App Attack
🇦🇺
clapper
2025-12-10 07:22:14
UTC ·
(11 months ago)
(mod_security) mod_security (id:949110) triggered by 64.227.162.39 (IN/India/-): 5 in the last 3600 secs; ID: rub
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-10 05:53:09
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 00:53:05.091319 2025] [security2:error] [pid 23033:tid 23033] [client 64.227.162.39:0] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 00:53:05.091319 2025] [security2:error] [pid 23033:tid 23033] [client 64.227.162.39:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||totalsafe-security.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "totalsafe-security.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTkKwYKRfs4qMr1ibjFD_wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Séfora Srl
2025-12-10 05:02:34
UTC ·
(11 months ago)
Failed attempt detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
jjnxpct
2025-12-10 04:48:55
UTC ·
(11 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /vendor/phpunit/phpunit/phpunit.xsd (Rule ID: 920440) - URL file extension is restricted by policy
Hacking
SQL Injection
Web App Attack
🇺🇸
Starburst SysOp Team
2025-12-10 04:30:09
UTC ·
(11 months ago)
(mod_security-custom) mod_security (id:210730) triggered by 64.227.162.39 (IN/India/Karnataka/Bengaluru/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs (0-srv1)
Hacking
🇦🇺
mjmouse
2025-12-10 03:47:00
UTC ·
(11 months ago)
64.227.162.39 darbybible.app - [10/Dec/2025:00:30:15 +0000] "GET /vendor/phpunit/phpunit/phpunit.xsd HTTP/1.0" 404 158 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
Hacking
Web App Attack
🇬🇧
pinguin
2025-12-10 03:18:26
UTC ·
(11 months ago)
Triggered Cloudflare WAF (firewallManaged) from IN.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: //vendor/phpunit/phpunit/phpunit.xsd
UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
This report was generated b ...
show more
Triggered Cloudflare WAF (firewallManaged) from IN.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: //vendor/phpunit/phpunit/phpunit.xsd
UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-10 02:09:03
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 21:09:00.312045 2025] [security2:error] [pid 22844:tid 22844] [client 64.227.162.39:0] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 64.227.162.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 21:09:00.312045 2025] [security2:error] [pid 22844:tid 22844] [client 64.227.162.39:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jspsf.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jspsf.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aTjWPA1jd69OYNhZHkdmpwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack