🇺🇸
TPI-Abuse
2026-10-21 11:34:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.198.91.98 (98.91.198.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 07:34:31.563034 2026] [security2:error] [pid 28547:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 104.198.91.98 (98.91.198.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 07:34:31.563034 2026] [security2:error] [pid 28547:tid 28547] [client 104.198.91.98:59236] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||justkoolit.onlyincanada-eh.com|F|2"] [data ".onlyincanada-eh.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "justkoolit.onlyincanada-eh.com"] [uri "/z9x8c7v6b5-debug-trigger-justkoolit.onlyincanada-eh.com"] [unique_id "atijR7rk53qibcRmRCKnPwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
Bots.go.to.hell
2026-10-21 10:38:10
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
Web App Attack
Hacking
🇺🇸
iwle
2026-10-21 06:29:54
(1 week ago)
[Wed Oct 21 02:29:52.131576 2026] [:error] [pid 208206:tid 208323] [client 104.198.91.98:51770] [client 104.198.91.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/acti ...
show more
[Wed Oct 21 02:29:52.131576 2026] [:error] [pid 208206:tid 208323] [client 104.198.91.98:51770] [client 104.198.91.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "153"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.justuptowngames.com"] [uri "/z9x8c7v6b5-debug-trigger-justuptowngames.com"] [unique_id "athb4HNjDpnwkaXqGCmrugAAAIM"], referer: https://justuptowngames.com/z9x8c7v6b5-debug-trigger-justuptowngames.com
[Wed Oct 21 02:29:52.705806 2026] [:error] [pid 208195:tid 208332] [client 104.198.91.98:51748] [client 104.198.91.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)
...
show less
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-10-21 06:17:00
(1 week ago)
2026-10-21 08:15:51 AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ) && 2026-10-21 08:15:52 AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env) && 2026-10-21 08:15:52 AH10244: invalid URI path (/public/plugins/aler ...
show more
2026-10-21 08:15:51 AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ) && 2026-10-21 08:15:52 AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env) && 2026-10-21 08:15:52 AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ) && 184 more within 20 minutes
show less
Web App Attack
2026-10-21 05:01:15
(1 week ago)
Web application attack: http path traversal probing; Web application attack: grafana cve 2021 43798; Web application attack: http sensitive files; Probing for exposed secret / credential files; Web application attack: http cve 2021 41773
Hacking
Web App Attack
🇺🇸
NetVexor
2026-10-21 04:46:24
(1 week ago)
Attack source identified and submitted via NetVexor BGP Blackhole Network
Port Scan
Hacking
Brute-Force
🇨🇱
Fernando Soto
2026-10-21 03:05:28
(1 week ago)
WAF propio vps1 (CL): sensMASx202 score 32 en 1h. sondeo rutas sensibles.
Web App Attack
🇩🇪
updown.io
2026-10-20 22:44:18
(1 week ago)
{"level":"info","ts":1792536256.2917643,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.198.91.98","remote_port":"42014","client_ip":"104.198.91.98","proto":"HTTP/2.0","method":"GET","host":"status.beeceptor.com"," ...
show more
{"level":"info","ts":1792536256.2917643,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.198.91.98","remote_port":"42014","client_ip":"104.198.91.98","proto":"HTTP/2.0","method":"GET","host":"status.beeceptor.com","uri":"/.dbeaver/credentials-config.json","headers":{"Accept-Encoding":["gzip"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"],"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.beeceptor.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.000116733,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1792536256.2932944,"logger":"http.log.access.log1","msg
...
show less
DDoS Attack
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-20 22:00:56
(1 week ago)
Auto-ban: >3000 req/min op 2026-10-20
Web App Attack
SSH
Hacking
🇫🇮
paissangroup
2026-10-20 21:27:50
(1 week ago)
Multiple WAF Violations
Web App Attack
🇹🇷
Jova
2026-10-20 20:42:56
(1 week ago)
Exploit attempts against a web server: 2 requests.
Hacking
Web App Attack
🇺🇸
jormaster3k
2026-10-20 20:32:49
(1 week ago)
Attack against Apache (too many 404s)
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-20 20:11:47
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 104.198.91.98 (JP/Japan/98.91.198.104.bc.googleusercontent.com): N in the last X secs
Web App Attack
🇪🇸
bohl-aiG5aef
2026-10-20 19:17:58
(1 week ago)
Suricata Alert [SID:2066030] ET HUNTING Javascript Sandbox Escape via Global Object (process)
Hacking
🇺🇸
Mehmet_The_Script_Kiddie
2026-10-20 19:07:40
(1 week ago)
CloudFlare WAF REPORT: /key.json
Bad Web Bot
Web App Attack
