🇩🇪
Jochen Pretli
2026-09-14 22:11:20
(1 day ago)
connection to honeypot
Email Spam
Port Scan
🇺🇸
RAP
2026-09-13 19:53:01
(2 days ago)
2026-09-13 19:53:01 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇩🇪
Jochen Pretli
2026-09-12 14:23:44
(4 days ago)
connection to honeypot
Email Spam
Port Scan
🇩🇪
Jochen Pretli
2026-09-04 08:43:47
(1 week ago)
connection to honeypot
Email Spam
Port Scan
🇺🇸
MPL
2026-09-01 22:18:10
(2 weeks ago)
tcp/23
Port Scan
🇩🇪
Admins@FBN
2026-08-27 07:52:51
(2 weeks ago)
FW-PortScan: Traffic Blocked srcport=40250 dstport=23
Port Scan
2026-08-24 13:45:10
(3 weeks ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇭🇰
mutebot.net
2026-08-23 15:50:14
(3 weeks ago)
SRC=123.183.190.133, PROTO=TCP, SPT=31357, DPT=23
Port Scan
🇺🇸
TPI-Abuse
2026-06-30 00:48:50
(2 months ago)
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 20:48:42.806220 2026] [security2:error] [pid 22972:tid 22972] [client 123.183.190.133:42843] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cosentient.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cosentient.com"] [uri "/"] [unique_id "akMSav_L3lFpDChzbYs1RAAAAAs"], referer: http://cosentient.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-08 04:48:48
(3 months ago)
[MonJun0806:48:44.1126652026][security2:error][pid658522:tid658633][client123.183.190.133:0]ModSecur ...
show more
[MonJun0806:48:44.1126652026][security2:error][pid658522:tid658633][client123.183.190.133:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"www.farmaciaferrari.ch\"][uri\"/\"][unique_id\"aiZJrHA7LKIsLRC6Be25LQAAAM0\"]\,referer:https://www.farmaciaferrari.ch/
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
RAP
2026-05-13 17:15:16
(4 months ago)
2026-05-13 17:15:16 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇺🇸
TPI-Abuse
2026-05-12 19:25:14
(4 months ago)
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 15:25:07.750225 2026] [security2:error] [pid 11039:tid 11060] [client 123.183.190.133:59809] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||philacentric.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "philacentric.com"] [uri "/"] [unique_id "agN-k063wZx83x6FyC2GAAAAANA"], referer: http://philacentric.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-28 01:15:27
(4 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2026-04-03 14:33:32
(5 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-02-04 23:17:16
(7 months ago)
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210831) triggered by 123.183.190.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 18:17:08.572400 2026] [security2:error] [pid 29203:tid 29203] [client 123.183.190.133:17056] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.leeknight.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.leeknight.com"] [uri "/"] [unique_id "aYPTdFmd_HAwa0p4OPDiBAAAABo"], referer: http://www.leeknight.com/
show less
Brute-Force
Bad Web Bot
Web App Attack