|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 03:22:29.817968 2026] [security2:error] [pid 27810:tid 27810] [client 64.64.99.5:42120] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||byles.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "byles.net"] [uri "/license.txt"] [unique_id "aiuztUgTAqPXRS0cG84vkAAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 02:56:08.781118 2026] [security2:error] [pid 6271:tid 6271] [client 64.64.99.5:27419] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||jeffj.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "jeffj.net"] [uri "/license.txt"] [unique_id "aiutiPEJKi9hP693RfShCAAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210801) triggered by 64.64.99.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 02:27:13.582634 2026] [security2:error] [pid 19190:tid 19190] [client 64.64.99.5:1383] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site||abakada.net|F|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "abakada.net"] [uri "/license.txt"] [unique_id "aiumweFDYPxsBEqN0dXk0gAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇷🇺
punctualsuspension968
|
|
blocked by ufw on TCP 6881
|
Port Scan
|
|
|
🇷🇺
punctualsuspension968
|
|
blocked by ufw on TCP 11834
|
Port Scan
|
|
|
Anonymous
|
|
tls scan
|
Port Scan
|
|
|
🇷🇺
punctualsuspension968
|
|
blocked by ufw on TCP 48177
|
Port Scan
|
|
|
🇷🇺
punctualsuspension968
|
|
blocked by ufw on TCP 48177
|
Port Scan
|
|
|
Anonymous
|
|
LH-Watcher: FAKE_ID [Fake Googlebot]
|
Bad Web Bot
|
|
|
🇬🇧
consul.to
|
|
Web attack/malicious scanning detected
|
Web App Attack
|
|
|
🇬🇧
consul.to
|
|
Web attack/malicious scanning detected
|
Web App Attack
|
|
|
Anonymous
|
|
tls scan
|
Port Scan
|
|
|
🇧🇷
hostseries
|
|
Trigger: LF_IMAPD
|
Brute-Force
|
|
|
🇺🇸
Starburst SysOp Team
|
|
Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-18)
|
Hacking
Bad Web Bot
|
|
|
🇺🇸
Jason Howell
|
|
64.64.99.5 - - [17/Aug/2025:19:26:45 -0500] "GET /wp-login.php HTTP/1.1" 200 4720 "-" "Mozilla/5.0 ( ...
show more
64.64.99.5 - - [17/Aug/2025:19:26:45 -0500] "GET /wp-login.php HTTP/1.1" 200 4720 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
64.64.99.5 - - [17/Aug/2025:19:26:47 -0500] "POST /wp-login.php HTTP/1.1" 200 2499 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
64.64.99.5 - - [17/Aug/2025:19:26:52 -0500] "GET /wp-login.php?redirect_to=https://blog.tatpl-traffic.com/wp-admin/&reauth=1 HTTP/1.1" 200 6890 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
64.64.99.5 - - [17/Aug/2025:19:47:02 -0500] "GET /wp-login.php HTTP/1.1" 200 4720 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
64.64.99.5 - - [17/Aug/2025:19:47:03 -0500] "POST /wp-login.php HTTP/1.1" 200 2499 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
...
show less
|
Web App Attack
|
|