🇩🇪
Ano_Nym
2026-10-22 23:47:20
(17 hours ago)
CrowdSec IDS alert on VPS 217.154.115.19 (DE). Scenario: crowdsecurity/http-bad-user-agent
Web App Attack
🇺🇸
TPI-Abuse
2026-01-27 02:47:18
(8 months ago)
(mod_security) mod_security (id:210381) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210381) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 21:47:12.303692 2026] [security2:error] [pid 1535:tid 1999] [client 92.112.217.204:45505] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||mail.kettlehill.com|F|4"] [data "REQUEST_URI=/account/?user=1&tab=groups&group-name=p%27+or+%27%%27=%27%%27+union+all+select+1,2,3,4,5,6,7,8,9,10,11,concat(%22Database:%22,md5(999999999),0x7c,%20%22Version:%22,version()),13--+-"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mail.kettlehill.com"] [uri "/account/"] [unique_id "aXgnMLZfoZ-BogEqpvEjZQAAARg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-26 23:43:36
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 19:42:18.905275 2025] [security2:error] [pid 26440:tid 26622] [client 92.112.217.204:59195] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ftp.kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ftp.kettlehill.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "aIVn2si-n1PXCScDgLsHwAAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-23 19:52:35
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-05-29 16:39:54
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 92.112.217.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 12:39:28.806274 2025] [security2:error] [pid 2998718:tid 2998718] [client 92.112.217.204:57251] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.farmers123.com|F|2"] [data ".cs"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.farmers123.com"] [uri "/nonauth/addCertException.cs"] [unique_id "aDiNwHHnKWQXGH9QZGWePQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-01-15 07:11:07
(1 year ago)
| Common web attack.
Hacking
SQL Injection
Web App Attack