🇺🇸
kosada.com
2026-11-12 07:55:06
UTC ·
(1 day ago)
Repeated requests for suspicious nonexistent URLs, for example: /plus/img/df_dedetitle.gif (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36")
Web App Attack
🇬🇧
CrystalMaker
2026-11-10 21:15:52
UTC ·
(2 days ago)
PHP vulnerability scan - GET /README.md; GET /README.md; GET /static/css/cmf-ide-helper.css; GET /miniprogram/code/default_baidu/app.js; GET /shoppingcart.php; GET /v1_0/company/index/sendCompanyLogo; GET /static/warn/close.php; GET /interface/public ...
show more
PHP vulnerability scan - GET /README.md; GET /README.md; GET /static/css/cmf-ide-helper.css; GET /miniprogram/code/default_baidu/app.js; GET /shoppingcart.php; GET /v1_0/company/index/sendCompanyLogo; GET /static/warn/close.php; GET /interface/public.php; GET /adminsoft/index.php?archive=adminuser&action=login; GET /index.php?s=index/show/buildHtml&htmlfile=chk_show&htmlpath=./caches; GET /includes/cls_sms.php; GET /Framework/ThinkPHP.php; GET /wap/index.php; GET /api/goods.php; GET /index.php?s=/admin/index/login; GET /espcms_admin/index.php; GET /static/warn/close.php; GET /static/css/cmf-ide-helper.css; GET /api/goods.php; GET /Framework/ThinkPHP.php; GET /includes/cls_sms.php; GET /wap/index.php; GET /interface/public.php; GET /adminsoft/index.php?archive=adminuser&action=login; GET /index.php?s=/admin/index/login; GET /index.php?s=index/show/buildHtml&htmlfile=chk_show&htmlpath=./caches; GET /miniprogram/code/default_baidu/app.js; GET /v1_0/company/index/sendCompanyLogo; GET /espcms_admin/index.php
show less
Web App Attack
🇳🇱
melroy89
2026-11-10 21:12:22
UTC ·
(2 days ago)
2026/11/10 22:12:22 [error] 2452557#2452557: *723198 limiting requests, excess: 5.671 by zone "ip", client: "139.159.249.205", server: "_", request_line: "GET /app/img/loading.gif HTTP/1.1", host: "cryptoterminal.org"
2026/11/10 22:12:22 [error] 2452 ...
show more
2026/11/10 22:12:22 [error] 2452557#2452557: *723198 limiting requests, excess: 5.671 by zone "ip", client: "139.159.249.205", server: "_", request_line: "GET /app/img/loading.gif HTTP/1.1", host: "cryptoterminal.org"
2026/11/10 22:12:22 [error] 2452561#2452561: *723202 limiting requests, excess: 5.626 by zone "ip", client: "139.159.249.205", server: "_", request_line: "GET /zb_users/emotion/face/Music.gif HTTP/1.1", host: "cryptoterminal.org"
2026/11/10 22:12:22 [error] 2452554#2452554: *723203 limiting requests, excess: 5.587 by zone "ip", client: "139.159.249.205", server: "_", request_line: "GET /zb_users/plugin/UEditor/themes/default/images/cursor_v.gif HTTP/1.1", host: "cryptoterminal.org"
...
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-08 17:24:29
UTC ·
(4 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
AetherFox
2026-11-08 11:18:33
UTC ·
(4 days ago)
AetherFox VoidGuard detected: [Sun Nov 08 11:18:29.954608 2026] [authz_core:error] [pid 2580270:tid 2580317] [client 139.159.249.205:54472] AH01630: client denied by server configuration: proxy:https://[MASKED]/, referer: https://forum.draconigen.net ...
show more
AetherFox VoidGuard detected: [Sun Nov 08 11:18:29.954608 2026] [authz_core:error] [pid 2580270:tid 2580317] [client 139.159.249.205:54472] AH01630: client denied by server configuration: proxy:https://[MASKED]/, referer: https://forum.draconigen.net/
[Sun Nov 08 11:18:31.273223 2026] [authz_core:error] [pid 2580270:tid 2580316] [client 139.159.249.205:54472] AH01630: client denied by server configuration: proxy:https://[MASKED]/ucms/img/loading.gif, referer: https://forum.draconigen.net/ucms/img/loading.gif
[Sun Nov 08 11:18:31.725541 2026] [authz_core:error] [pid 2580270:tid 2580312] [client 139.159.249.205:54472] AH01630: client denied by server configuration: proxy:https://[MASKED]/public/ui/met/images/dt-9.gif, referer: https://forum.draconigen.net/public/ui/met/images/dt-9.gif
[Sun Nov 08 11:18:31.952339 2026] [authz_core:error] [pid 2580270:tid 2580323] [client 139.159.249.205:54472] AH01630: client denied by server configuration: proxy:https://5.75.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 23:05:16
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:05:11.653684 2026] [security2:error] [pid 19 ...
show more
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:05:11.653684 2026] [security2:error] [pid 19992:tid 19992] [client 139.159.249.205:56960] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||richardnash.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "richardnash.com"] [uri "/okok.cer"] [unique_id "au-upxXGtPfcr99ufbCG0wAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 22:44:39
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:44:33.580049 2026] [security2:error] [pid 70 ...
show more
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:44:33.580049 2026] [security2:error] [pid 7052:tid 7052] [client 139.159.249.205:53582] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||richardpetersbooks.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "richardpetersbooks.com"] [uri "/okok.cer"] [unique_id "au-p0Vvq80MVN3SOPoKToQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-07 19:29:54
UTC ·
(5 days ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Bad Web Bot
🇮🇹
VHosting
2026-11-07 16:20:05
UTC ·
(5 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 14:31:15
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:31:09.492747 2026] [security2:error] [pid 25 ...
show more
(mod_security) mod_security (id:210730) triggered by 139.159.249.205 (ecs-139-159-249-205.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:31:09.492747 2026] [security2:error] [pid 25844:tid 25844] [client 139.159.249.205:58368] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||pascalroy.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pascalroy.com"] [uri "/okok.cer"] [unique_id "au82LShTILbzyKrhsTJaEgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-11-07 14:05:15
UTC ·
(5 days ago)
Too many Status 40X (15)
Brute-Force
Web App Attack
🇦🇲
lime
2021-09-11 02:51:04
UTC ·
(5 years ago)
Port Scan, Web Attack
Port Scan
Web App Attack
🇺🇸
HamSammich
2021-09-06 04:00:00
UTC ·
(5 years ago)
IP connected to honeypot on port 6379 before being firewalled.
Port Scan
Hacking
🇩🇪
_ArminS_
2021-09-05 10:18:12
UTC ·
(5 years ago)
SP-Scan 33586:6379 detected 2021.09.05 12:18:12
blocked until 2021.10.25 05:20:59
Port Scan
🇹🇭
Sawasdee
2021-09-05 05:33:06
UTC ·
(5 years ago)
Port Scan/VNC login attempt
...
Port Scan
