🇺🇸
Starburst SysOp Team
2026-04-15 12:15:05
(1 month ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-14)
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-16 19:54:33
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 15:54:30.438684 2026] [security2:error] [pid 6439:tid 6439] [client 85.203.45.107:50131] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hodlmoser.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hodlmoser.com"] [uri "/backups/dump.sql"] [unique_id "abhf9sz-qesc_XoEjZSmswAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-04 23:12:10
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 18:12:06.992621 2026] [security2:error] [pid 17314:tid 17325] [client 85.203.45.107:20309] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bluetigertees.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bluetigertees.com"] [uri "/bak/wallet.dat"] [unique_id "aai8RtuIluP1vd0KTWkS1AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-28 21:08:54
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 28 16:08:50.747802 2026] [security2:error] [pid 29079:tid 29079] [client 85.203.45.107:27001] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.crypto-stamps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.crypto-stamps.com"] [uri "/bak/dump.sql"] [unique_id "aaNZYo0StNRFmF2ZMbpNngAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-27 12:17:59
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 27 07:17:52.361720 2026] [security2:error] [pid 31068:tid 31068] [client 85.203.45.107:60793] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bitcointoolfair.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bitcointoolfair.com"] [uri "/back/backup.sql"] [unique_id "aaGLcOBXNEKtg5_xB4DN3gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
S.O.B.A. Dev.
2026-02-26 13:40:53
(3 months ago)
Threat Blocked by BeeHive from (ASN:9009) (Network:M247) (Host:soba.dev) (Method:HEAD) (Protocol:HTT ...
show more
Threat Blocked by BeeHive from (ASN:9009) (Network:M247) (Host:soba.dev) (Method:HEAD) (Protocol:HTTP/1.1) (Timestamp:2026-02-26T13:40:53Z)
show less
Brute-Force
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-02-04 12:29:28
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 07:29:21.711509 2026] [security2:error] [pid 3759:tid 3759] [client 85.203.45.107:21359] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mpaexchangeinc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mpaexchangeinc.com"] [uri "/old/dump.sql"] [unique_id "aYM7oSOtyuPBoUs8sae06AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 06:19:04
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 01:18:57.520011 2026] [security2:error] [pid 19010:tid 19010] [client 85.203.45.107:63935] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.spectorworld.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.spectorworld.com"] [uri "/restore/mysql.sql"] [unique_id "aXr70UCgP_Im9ZpicxEySwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-01-22 18:05:32
(4 months ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇺🇸
Penny Packer
2026-01-22 13:59:41
(4 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇩🇪
ghostwarriors
2026-01-12 15:20:36
(4 months ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-01-12 15:19:44
(4 months ago)
Bad bot ignoring robot.txt
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-10 00:43:36
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 09 19:43:30.005132 2026] [security2:error] [pid 31786:tid 31786] [client 85.203.45.107:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eddysgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/back/dump.sql"] [unique_id "aWGgsgK8Ia-8hHbaw_bMQQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2026-01-09 04:02:41
(4 months ago)
/restore/latest.zip
Hacking
Web App Attack
🇩🇪
bescared
2026-01-09 01:30:11
(4 months ago)
F2B - Malicious activity detected. URL Probing.
Hacking
Bad Web Bot
Web App Attack