🇳🇱
Alt255
2026-11-12 20:41:58
UTC ·
(6 hours ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 85.203.20.65 - - [12/Nov/2026:21:41:36 +0100] "GET /modules/mod_simplefileuploadv1.3/elements/udd.php HTTP/1.1" 403 463 "-" "Mozilla/5.0 (Windows ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 85.203.20.65 - - [12/Nov/2026:21:41:36 +0100] "GET /modules/mod_simplefileuploadv1.3/elements/udd.php HTTP/1.1" 403 463 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-10-30 03:04:38
UTC ·
(1 week ago)
Web App Attack
🇮🇹
VHosting
2026-10-29 17:00:05
UTC ·
(2 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇨🇭
backslash
2026-09-05 05:33:00
UTC ·
(2 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
threatintelligence_bvc
2026-04-28 08:56:49
UTC ·
(6 months ago)
Brute-Force
🇺🇸
TPI-Abuse
2026-03-12 07:25:03
UTC ·
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 03:24:55.358115 2026] [security2:error] [pid 14350:tid 14350] [client 85.203.20.65:51173] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 03:24:55.358115 2026] [security2:error] [pid 14350:tid 14350] [client 85.203.20.65:51173] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||secureonebank.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "secureonebank.net"] [uri "/mysql.sql"] [unique_id "abJqR_VHlvwCurwkY08TnQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
DZBOT
2026-03-11 09:06:45
UTC ·
(8 months ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
Penny Packer
2026-02-13 09:29:31
UTC ·
(8 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2026-02-11 04:28:01
UTC ·
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 23:27:55.961911 2026] [security2:error] [pid 24591:tid 24591] [client 85.203.20.65:42337] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 23:27:55.961911 2026] [security2:error] [pid 24591:tid 24591] [client 85.203.20.65:42337] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uppermotradingco.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uppermotradingco.com"] [uri "/backups/backup.sql"] [unique_id "aYwFS8jKjR3HN1iKLYNAZQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-09 04:47:42
UTC ·
(9 months ago)
Multiple web server 400 error codes from same source ip
Web App Attack
2026-02-07 12:57:22
UTC ·
(9 months ago)
wordpress-trap
Web App Attack
🇺🇸
TPI-Abuse
2026-02-07 04:45:15
UTC ·
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 23:45:09.351909 2026] [security2:error] [pid 29892:tid 29892] [client 85.203.20.65:56977] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 23:45:09.351909 2026] [security2:error] [pid 29892:tid 29892] [client 85.203.20.65:56977] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||qualityelevatorcabs.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "qualityelevatorcabs.com"] [uri "/mysql.sql"] [unique_id "aYbDVSBCRdp_CS3DzHoeZQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-06 17:47:30
UTC ·
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 12:47:21.966317 2026] [security2:error] [pid 31851:tid 31851] [client 85.203.20.65:31959] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 12:47:21.966317 2026] [security2:error] [pid 31851:tid 31851] [client 85.203.20.65:31959] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.domainexecs.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.domainexecs.com"] [uri "/backups/www.sql"] [unique_id "aYYpKTljSHgcTr22X899VgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-05 20:08:26
UTC ·
(9 months ago)
(mod_security) mod_security (id:240000) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 15:08:21.692528 2026] [security2:error] [pid 30467:tid 30467] [client 85.203.20.65:54197] Mod ...
show more
(mod_security) mod_security (id:240000) triggered by 85.203.20.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 15:08:21.692528 2026] [security2:error] [pid 30467:tid 30467] [client 85.203.20.65:54197] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||ileronde.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "ileronde.com"] [uri "/images/stories/themes.php"] [unique_id "aYT4tWAnGoTEOw0T_civ5AAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-02-05 15:06:43
UTC ·
(9 months ago)
85.203.20.65 - - [05/Feb/2026:15:06:42 +0000] "GET /wp-content/edit-wolf.php HTTP/1.1" 302 461 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36"
...
Bad Web Bot
Web App Attack
