🇵🇾
armandosaucedo.me
2026-03-15 01:29:48
(3 months ago)
98.159.226.187 - - [15/Mar/2026:01:29:35 +0000] "GET /restore/directory.tar HTTP/1.1" 404 196 "-" "- ...
show more
98.159.226.187 - - [15/Mar/2026:01:29:35 +0000] "GET /restore/directory.tar HTTP/1.1" 404 196 "-" "-"
show less
Web App Attack
🇯🇵
Valhalla
2026-03-10 21:43:19
(3 months ago)
/backup/backup.zip
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-03-04 19:33:25
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 14:33:19.012013 2026] [security2:error] [pid 18839:tid 18839] [client 98.159.226.187:56825] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uppermotradingco.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uppermotradingco.com"] [uri "/restore/www.sql"] [unique_id "aaiI_4emGQYadjdUk3QVvgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-27 07:08:50
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 27 02:08:42.046843 2026] [security2:error] [pid 5190:tid 5190] [client 98.159.226.187:59951] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bitcoinsquaretrader.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bitcoinsquaretrader.com"] [uri "/wallet.dat"] [unique_id "aaFC-ksHV88Gy1dO3rPlMQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mikekarl
2026-02-27 03:05:30
(3 months ago)
Empty or bad user-agent.
Bad Web Bot
🇬🇧
consul.to
2026-02-26 18:06:00
(3 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 22:25:21
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 17:25:16.680863 2026] [security2:error] [pid 26848:tid 26848] [client 98.159.226.187:62469] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kwtlaw.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kwtlaw.com"] [uri "/back/sql.sql"] [unique_id "aZ92zNGkTgyngqLWmTogrgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 16:16:31
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 11:16:23.731302 2026] [security2:error] [pid 16681:tid 16681] [client 98.159.226.187:39791] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dudleyanddudley.com"] [uri "/back/sftp-config.json"] [unique_id "aZ8gV4ODYRzw-C7lX9rDtwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-02-25 15:23:53
(3 months ago)
HTTP vulnerability scanning
Web App Attack
🇯🇵
Valhalla
2026-02-24 14:43:41
(3 months ago)
/backups/public_html.gz
Hacking
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-02-24 13:51:49
(3 months ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-02-20 02:13:45
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 21:13:38.139643 2026] [security2:error] [pid 439:tid 439] [client 98.159.226.187:60837] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||3dsportschannel.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "3dsportschannel.com"] [uri "/backup/www.sql"] [unique_id "aZfDUk4kmaYEIVT2FnNTpgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-19 20:39:00
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 15:38:55.365642 2026] [security2:error] [pid 17710:tid 17710] [client 98.159.226.187:30219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crypto-stamps.com"] [uri "/restore/sftp-config.json"] [unique_id "aZd030QRx7CpRY4mj_ckGAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-18 22:47:39
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 98.159.226.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 17:47:32.161552 2026] [security2:error] [pid 6862:tid 6862] [client 98.159.226.187:32553] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindtoken.app"] [uri "/backups/sftp-config.json"] [unique_id "aZZBhGLspDCVOu8QVep7_wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
DZBOT
2026-02-18 03:36:32
(4 months ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack