🇩🇪
LRob
2026-11-15 08:48:46
UTC ·
(49 minutes ago)
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/92268e738f2257188f087c96b454d024a37817af/internal/api/whitelist_grant_test.go | src_port: 36672 | ua: Mozilla/5.0 ...
show more
Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader | path: /Shieldlist/shieldlist-controller/src/commit/92268e738f2257188f087c96b454d024a37817af/internal/api/whitelist_grant_test.go | src_port: 36672 | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 | 2026-11-15 08:48 UTC
show less
DDoS Attack
Bad Web Bot
🇫🇷
COMAITE
2026-11-01 22:15:41
UTC ·
(1 week ago)
SQL injection attempt from 101.43.158.69.
Web App Attack
🇫🇷
vtchost.com
2026-10-28 09:45:54
UTC ·
(2 weeks ago)
requested HTTP honeypot page - ignored robots.txt - bad crawler
...
Bad Web Bot
Exploited Host
🇷🇺
Mga Admin
2026-10-27 01:16:11
UTC ·
(2 weeks ago)
101.43.158.69 - - [27/Oct/2026:08:16:10 +0700] "GET /help/security/passwords_for_integrated_authentication_methods.md HTTP/1.1" 404 1360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537 ...
show more
101.43.158.69 - - [27/Oct/2026:08:16:10 +0700] "GET /help/security/passwords_for_integrated_authentication_methods.md HTTP/1.1" 404 1360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇫🇷
Tilellit.PRO
2026-10-26 07:46:28
UTC ·
(2 weeks ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
🇯🇵
Short-legs-Spider
2026-09-27 15:48:57
UTC ·
(1 month ago)
Persistent request
--
[28/Sep/2026:00:48:57 +0900] "GET /==1.htm HTTP/2.0" 403 76 "https://==.jp/==1.htm" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
Bad Web Bot
🇮🇩
hermawan
2026-09-26 00:18:00
UTC ·
(1 month ago)
Captured JA4H: ge11n_04726067e501 | Log: 101.43.158.69 - - [26/Sep/2026:07:17:58 +0700] "GET /index.php/profil/meteorologi/list-all-categories/4166-klimatologi/infografis/infografis-klimatologi/infografis-dasarian/infografis-dasarian-tahun-2023/55556 ...
show more
Captured JA4H: ge11n_04726067e501 | Log: 101.43.158.69 - - [26/Sep/2026:07:17:58 +0700] "GET /index.php/profil/meteorologi/list-all-categories/4166-klimatologi/infografis/infografis-klimatologi/infografis-dasarian/infografis-dasarian-tahun-2023/555560551-infografis-dasarian-informasi-iklim-jatim-update-10-november-tahun-2023 HTTP/1.1" 200 14707 "https://staklim-jatim.bmkg.go.id/index.php/profil/meteorologi/list-all-categories/4166-klimatologi/infografis/infografis-klimatologi/infografis-dasarian/infografis-dasarian-tahun-2023/555560551-infografis-dasarian-informasi-iklim-jatim-update-10-november-tahun-2023" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,upgrade-insecure-requests,cf-ew-via,cdn-loop,sec-fetch-user,sec-fetch-site,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-mode,cf-visit
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-09-23 04:04:49
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 101.43.158.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 00:04:44.111083 2026] [security2:error] [pid 12372:tid 12372] [client 101.43.158.69:57166] M ...
show more
(mod_security) mod_security (id:210730) triggered by 101.43.158.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 00:04:44.111083 2026] [security2:error] [pid 12372:tid 12372] [client 101.43.158.69:57166] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||picayunity.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "picayunity.com"] [uri "/2006/summer/WS_FTP.LOG"] [unique_id "arNP3DmGjERX35Mma5UiOgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-14 22:51:44
UTC ·
(2 months ago)
Blocked by ModSec and CSF
Port Scan
🇩🇪
nyuuzyou
2026-09-14 10:53:00
UTC ·
(2 months ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-09-14T10:53:00Z.
Bad Web Bot
🇩🇪
LRob
2026-09-09 09:08:16
UTC ·
(2 months ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /controle-technique/pneus-auto-4x4-utilitaires/controle-technique-vl/a-propos/technologies-embarquees-poids-lourds-cars-bu ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /controle-technique/pneus-auto-4x4-utilitaires/controle-technique-vl/a-propos/technologies-embarquees-poids-lourds-cars-bus/vide | 2026-09-09 09:08 UTC
show less
Bad Web Bot
🇫🇷
bigorre.org
2026-09-07 10:36:16
UTC ·
(2 months ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
2026-09-06 06:00:14
UTC ·
(2 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp
Exploited Host
Bad Web Bot
