🇫🇷
dynamix
2026-06-25 13:27:47
(10 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇺🇸
Dolphi
2026-06-25 08:20:17
(15 hours ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇯🇵
Valhalla
2026-02-27 15:25:32
(3 months ago)
/back/archive.zip
Hacking
Web App Attack
🇫🇷
dynamix
2026-02-11 03:16:39
(4 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-01-26 02:45:38
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 25 21:45:31.540246 2026] [security2:error] [pid 9568:tid 9568] [client 85.203.20.37:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ccamp.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ccamp.dev"] [uri "/back/mysql.sql"] [unique_id "aXbVS5m8vv3FezyOb3DnvAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Penny Packer
2026-01-13 14:13:17
(5 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇩🇪
bescared
2026-01-10 09:46:35
(5 months ago)
F2B - Malicious activity detected. URL Probing.
Hacking
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2026-01-01 06:09:22
(5 months ago)
/backups/www.tar
Hacking
Web App Attack
🇺🇸
Penny Packer
2025-12-28 01:33:28
(5 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
Penny Packer
2025-12-24 01:12:41
(6 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2025-12-16 15:07:34
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 16 10:07:27.579795 2025] [security2:error] [pid 21407:tid 21407] [client 85.203.20.37:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eddysgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/backup/www.sql"] [unique_id "aUF1r4Kwkt-AqFd-clOhAQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2025-12-04 05:40:04
(6 months ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 85.203.20.37 (HR/Croatia ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 85.203.20.37 (HR/Croatia/-)
show less
Port Scan
🇫🇷
dynamix
2025-12-03 06:20:11
(6 months ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2025-11-30 00:08:28
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 19:08:25.032398 2025] [security2:error] [pid 23311:tid 23311] [client 85.203.20.37:31305] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||headcount.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "headcount.dev"] [uri "/back/mysql.sql"] [unique_id "aSuK-WuSq9ddu7wM5H2l3QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:19:37
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:19:33.772294 2025] [security2:error] [pid 1647076:tid 1647099] [client 85.203.20.37:44675] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nobletitles.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nobletitles.org"] [uri "/back/backup.sql"] [unique_id "aSUgReH4DuV7HFq4iAkGiwAAARM"]
show less
Brute-Force
Bad Web Bot
Web App Attack