🇬🇧
Axel
2024-06-27 07:56:01
UTC ·
(2 years ago)
Access to sensitive file detected: 85.203.45.55 - - [27/Jun/2024:07:54:06 +0000] "HEAD /backup/config.json HTTP/1.0" 302 759 "-" "-"
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-06-27 07:53:44
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 27 03:53:36.918644 2024] [security2:error] [pid 28711] [client 85.203.45.55:12297] [client 85.20 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 27 03:53:36.918644 2024] [security2:error] [pid 28711] [client 85.203.45.55:12297] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||thegoldentether.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thegoldentether.com"] [uri "/backups/dump.sql"] [unique_id "Zn0agM55urj4h9SpnC0X0gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-06-24 00:40:05
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 23 20:39:56.831483 2024] [security2:error] [pid 17669] [client 85.203.45.55:49163] [client 85.20 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 23 20:39:56.831483 2024] [security2:error] [pid 17669] [client 85.203.45.55:49163] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lundtrading.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lundtrading.com"] [uri "/old/backup.sql"] [unique_id "ZnjAXFqxJVm8ypPVyZSMcgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-06-20 19:36:08
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 20 15:36:01.645884 2024] [security2:error] [pid 16136] [client 85.203.45.55:5965] [client 85.203 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 20 15:36:01.645884 2024] [security2:error] [pid 16136] [client 85.203.45.55:5965] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cvgandhes.investments|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cvgandhes.investments"] [uri "/old/mysql.sql"] [unique_id "ZnSEoUhAD4gMGdyWRxI7ugAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-05-25 21:00:11
UTC ·
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇺🇸
TPI-Abuse
2024-05-25 19:32:45
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 25 15:32:40.565781 2024] [security2:error] [pid 3308] [client 85.203.45.55:10607] [client 85.203 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 25 15:32:40.565781 2024] [security2:error] [pid 3308] [client 85.203.45.55:10607] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.crypto-stamps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.crypto-stamps.com"] [uri "/bak/dump.sql"] [unique_id "ZlI82Ir9NA6xbyjkDEdVLgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-24 00:10:40
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 23 20:10:33.555240 2024] [security2:error] [pid 1973473] [client 85.203.45.55:62081] [client 85. ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 23 20:10:33.555240 2024] [security2:error] [pid 1973473] [client 85.203.45.55:62081] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||csgohub.gg|F|2"] [data ".gg.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "csgohub.gg"] [uri "/bak/csgohub.gg.sql"] [unique_id "ZihN-V3vZzMXpaG22iyhlgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-04-23 12:08:45
UTC ·
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇺🇸
TPI-Abuse
2024-04-23 10:30:15
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 23 06:30:07.371081 2024] [security2:error] [pid 20110] [client 85.203.45.55:42551] [client 85.20 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 23 06:30:07.371081 2024] [security2:error] [pid 20110] [client 85.203.45.55:42551] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dudleyanddudley.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dudleyanddudley.com"] [uri "/bak/wallet.dat"] [unique_id "ZieNr8Fj4Ois3QuaUTRH7gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-20 14:44:10
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 10:44:04.383055 2024] [security2:error] [pid 24839] [client 85.203.45.55:32047] [client 85.20 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 20 10:44:04.383055 2024] [security2:error] [pid 24839] [client 85.203.45.55:32047] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mapleleaf-marketing.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mapleleaf-marketing.com"] [uri "/restore/backup.sql"] [unique_id "ZiPUtKKjr8seVaW4GatT8gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
hbrks
2024-04-17 16:36:50
UTC ·
(2 years ago)
http://_/ * statusCode: 400 * user-agent:DDOS Attack
Web Spam
Hacking
Bad Web Bot
🇩🇪
hbrks
2024-04-17 15:49:56
UTC ·
(2 years ago)
HEAD http://marche-be.com/backup/www.tar.gz * statusCode: 503 *
Web Spam
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2024-04-16 19:40:26
UTC ·
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 16 15:40:20.647110 2024] [security2:error] [pid 28699] [client 85.203.45.55:64211] [client 85.20 ...
show more
(mod_security) mod_security (id:210492) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 16 15:40:20.647110 2024] [security2:error] [pid 28699] [client 85.203.45.55:64211] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yakski.com"] [uri "/restore/sftp-config.json"] [unique_id "Zh7UJMxQzfAC3jUPEnwtzgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-12 16:01:13
UTC ·
(2 years ago)
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 12 12:01:09.899367 2024] [security2:error] [pid 9411] [client 85.203.45.55:15269] [client 85.203 ...
show more
(mod_security) mod_security (id:210730) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 12 12:01:09.899367 2024] [security2:error] [pid 9411] [client 85.203.45.55:15269] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ciptaconindotara.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ciptaconindotara.com"] [uri "/backups/sql.sql"] [unique_id "ZhlaxWP7Zw251G7FIJC0awAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-04-07 05:22:05
UTC ·
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 07 01:21:59.113440 2024] [security2:error] [pid 1974363] [client 85.203.45.55:31115] [client 85. ...
show more
(mod_security) mod_security (id:210492) triggered by 85.203.45.55 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 07 01:21:59.113440 2024] [security2:error] [pid 1974363] [client 85.203.45.55:31115] [client 85.203.45.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "usbea.com"] [uri "/backup/.env"] [unique_id "ZhItd3zk-E4GtO12tH0_GgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
