2026-10-06 07:02:20
UTC ·
(1 month ago)
Image scraping bot bypassing firewall/robots.txt restrictions in getImage.asp
Bad Web Bot
🇺🇸
鬼影233
2026-09-20 14:31:35
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 00:40:23
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
WeekendWeb
2026-07-30 06:18:55
UTC ·
(3 months ago)
Wordpress Vunerability attack
Web App Attack
🇺🇸
TPI-Abuse
2026-07-30 05:47:38
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 01:47:33.238044 2026] [security2:error] [pid 2404351:tid 2404356] [client 103.93.93.199:5178 ...
show more
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 01:47:33.238044 2026] [security2:error] [pid 2404351:tid 2404356] [client 103.93.93.199:51786] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.93.93.199 (+1 hits since last alert)|pwihatah.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pwihatah.com"] [uri "/xmlrpc.php"] [unique_id "amrldSiHRSvOczSVSr2EHgAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-30 05:21:09
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 01:21:04.951974 2026] [security2:error] [pid 1534853:tid 1534853] [client 103.93.93.199:5186 ...
show more
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 01:21:04.951974 2026] [security2:error] [pid 1534853:tid 1534853] [client 103.93.93.199:51866] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.93.93.199 (+1 hits since last alert)|jimrichardart.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jimrichardart.com"] [uri "/xmlrpc.php"] [unique_id "amrfQLyH1DbYb8aoMM2fmQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-26 06:41:48
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-23 03:55:13
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (internet-cepat-103-93-93-199.myriseid.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 23:55:05.080876 2026] [security2:error] [pid 1713712 ...
show more
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (internet-cepat-103-93-93-199.myriseid.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 23:55:05.080876 2026] [security2:error] [pid 1713712:tid 1713712] [client 103.93.93.199:49519] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.93.93.199 (+1 hits since last alert)|josephshv.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "josephshv.com"] [uri "/xmlrpc.php"] [unique_id "amGQmRARGb1FjDrDzOKkUwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-07-21 06:13:15
UTC ·
(3 months ago)
(xmlrpc_405) XMLRPC-Bot 405 103.93.93.199 (ID/Indonesia/-)
Hacking
🇺🇸
TPI-Abuse
2026-07-15 02:15:34
UTC ·
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 22:15:29.009095 2026] [security2:error] [pid 26319:tid 26319] [client 103.93.93.199:58939] M ...
show more
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 22:15:29.009095 2026] [security2:error] [pid 26319:tid 26319] [client 103.93.93.199:58939] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.93.93.199 (+1 hits since last alert)|assembliesofgodinsamoa.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "assembliesofgodinsamoa.org"] [uri "/xmlrpc.php"] [unique_id "albtQdivwuIej7jWe3LglwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-26 09:07:10
UTC ·
(4 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp
Exploited Host
Bad Web Bot
🇰🇷
zlhIcd
2026-06-16 00:49:39
UTC ·
(4 months ago)
103.93.93.199 - - [15/Jun/2026:19:40:07 +0900] "GET /pcwiki/index.php?days=30&from=20251027100555&hideminor=1&hidemyself=1&limit=500&target=Pds&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1 ...
show more
103.93.93.199 - - [15/Jun/2026:19:40:07 +0900] "GET /pcwiki/index.php?days=30&from=20251027100555&hideminor=1&hidemyself=1&limit=500&target=Pds&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1" 404 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:132.0) Gecko/20100101 Firefox/132.0"
...
show less
Web Spam
SQL Injection
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-12 03:53:49
UTC ·
(4 months ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇺🇸
TPI-Abuse
2026-06-12 03:13:04
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 23:12:56.273520 2026] [security2:error] [pid 13444:tid 13452] [client 103.93.93.199:62449] M ...
show more
(mod_security) mod_security (id:240335) triggered by 103.93.93.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 23:12:56.273520 2026] [security2:error] [pid 13444:tid 13452] [client 103.93.93.199:62449] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 103.93.93.199 (+1 hits since last alert)|jimlawrencesongs.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jimlawrencesongs.com"] [uri "/xmlrpc.php"] [unique_id "ait5OImG6egAyGhpQLga_QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇳
evicky2002
2026-05-28 07:33:20
UTC ·
(5 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=3)
Hacking
Brute-Force
SSH
