🇺🇸
kosada.com
2026-07-11 18:22:30
(1 week ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇨🇭
backslash
2026-07-05 12:21:08
(2 weeks ago)
block ruleset DA4A07AEE48B136A3922182BE8AA8BFBC1840803
Bad Web Bot
🇺🇸
kosada.com
2026-06-29 09:27:26
(3 weeks ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
hermawan
2026-06-06 04:33:21
(1 month ago)
[Sat Jun 06 11:33:17.490001 2026] [security2:error] [pid 1500488:tid 140021309793984] [client 103.16 ...
show more
[Sat Jun 06 11:33:17.490001 2026] [security2:error] [pid 1500488:tid 140021309793984] [client 103.166.170.239:46186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasarian-analisis-kejadian-hujan-lebat HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/infografis-iklim/infografis-dasarian/infografis-dasarian-analisis-kejadian-hujan-lebat"] [unique_id "aiOjDQ3FnoMudcrosvFiYAAAxhg"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1500513] [RhCxRo5YI3E] [aiOjDQ3FnoMudcrosvFiYAAAxhg] keep_alive=[1] [2026-06-06
...
show less
Email Spam
Hacking
🇩🇪
milcraft.nl
2026-05-20 00:23:40
(2 months ago)
Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi ...
show more
Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse.
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-04-16 17:01:08
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 103.166.170.239 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 103.166.170.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 13:01:02.276176 2026] [security2:error] [pid 1582667:tid 1582667] [client 103.166.170.239:37082] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||journeysinprayerandsong.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "journeysinprayerandsong.com"] [uri "/links2_files/WS_FTP.LOG"] [unique_id "aeEVztni5A9x6xD6DSNnawAAAAc"], referer: http://journeysinprayerandsong.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-03-24 11:30:37
(3 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
2026-02-15 01:23:37
(5 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-01-31 22:08:44
(5 months ago)
(mod_security) mod_security (id:217210) triggered by 103.166.170.239 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:217210) triggered by 103.166.170.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 31 17:08:35.217412 2026] [security2:error] [pid 258198:tid 258198] [client 103.166.170.239:45988] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||moon61placess.top|F|4"] [data "GET http://moon61placess.top HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "moon61placess.top"] [uri "/"] [unique_id "aX59Y7yi7fVx8y0xFMjMpwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-18 23:49:43
(6 months ago)
Unauthorized connection attempt on Port 23
Port Scan
Hacking
Exploited Host
2025-12-09 11:58:49
(7 months ago)
botnet
DDoS Attack
2025-11-26 00:56:17
(7 months ago)
scanning http requests from known botnet
Web App Attack
2025-11-17 23:52:02
(8 months ago)
scanning http requests from known botnet
Web App Attack
2025-11-15 08:12:10
(8 months ago)
scanning http requests from known botnet
Web App Attack
🇳🇱
exxos
2025-08-01 02:36:34
(11 months ago)
HTTP1.x attacks
DDoS Attack