🇩🇪
4server
2026-06-17 12:07:13
(1 day ago)
[WedJun1714:07:08.7100342026][security2:error][pid2757574:tid2757734][client152.67.8.205:0]ModSecuri ...
show more
[WedJun1714:07:08.7100342026][security2:error][pid2757574:tid2757734][client152.67.8.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mail.wildpferde.ch\"][uri\"/.env.development\"][unique_id\"ajKN7IcRbfUGGPB3lw5wQAAAAMw\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 11:07:13
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 07:07:05.363772 2026] [security2:error] [pid 10033:tid 10055] [client 152.67.8.205:19172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "richardleeweatherman.com"] [uri "/.env.claude.gpg"] [unique_id "ajJ_2Q2ZQycsYff-qfAL7AAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 09:56:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 05:56:49.199962 2026] [security2:error] [pid 24654:tid 24656] [client 152.67.8.205:21722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloradomohs.aafm.us"] [uri "/.gemini/.env"] [unique_id "ajJvYQik8_WPsts3DmsaYAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇳
Public CSIRT/CC of Mongolia
2026-06-17 08:27:19
(1 day ago)
Honeypot hit: Incoming HTTP traffic on port 81
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-16 20:21:38
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 152.67.8.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 16:21:34.113914 2026] [security2:error] [pid 5075:tid 5075] [client 152.67.8.205:35914] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||garyandthegroove.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "garyandthegroove.com"] [uri "/telegram_messages.db"] [unique_id "ajGwTvKeZTE9ha8mA5BvgAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2026-06-16 07:54:38
(2 days ago)
Form spam
Web Spam
🇦🇺
oncord
2026-06-12 13:11:20
(6 days ago)
Form spam
Web Spam
🇬🇧
killian7603
2026-06-06 21:02:52
(1 week ago)
Logon Policy Violation
Email Spam
Spoofing
Brute-Force
🇨🇿
Honzas
2026-05-27 01:09:03
(3 weeks ago)
Brute Force SMTP AUTH Attack
Brute-Force
🇮🇹
VHosting
2026-05-26 12:47:37
(3 weeks ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇮🇱
spd.co.il
2026-05-22 06:02:52
(3 weeks ago)
Web application attack detected
Hacking
Web App Attack
🇨🇿
lp
2026-05-13 03:20:15
(1 month ago)
Email account brute force: 2 attempts were recorded from 152.67.8.205
2026-05-13T05:02:06+02:00 warn ...
show more
Email account brute force: 2 attempts were recorded from 152.67.8.205
2026-05-13T05:02:06+02:00 warning: unknown[152.67.8.205]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-05-13T05:02:10+02:00 warning: unknown[152.67.8.205]: SASL LOGIN authentication failed: authentication failure, [email protected]
show less
Brute-Force
🇮🇱
spd.co.il
2026-05-12 13:01:36
(1 month ago)
Web application attack detected
Hacking
Web App Attack
🇮🇩
Burayot
2026-05-04 07:19:31
(1 month ago)
LF_EXIMSYNTAX: (eximsyntax) Exim syntax errors from 152.67.8.205 (IN/India/-): 1 in the last 3600 se ...
show more
LF_EXIMSYNTAX: (eximsyntax) Exim syntax errors from 152.67.8.205 (IN/India/-): 1 in the last 3600 secs
show less
Brute-Force
🇨🇿
lp
2026-05-03 13:50:56
(1 month ago)
Email account brute force: 2 attempts were recorded from 152.67.8.205
2026-05-03T14:13:27+02:00 warn ...
show more
Email account brute force: 2 attempts were recorded from 152.67.8.205
2026-05-03T14:13:27+02:00 warning: unknown[152.67.8.205]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-05-03T14:13:40+02:00 warning: unknown[152.67.8.205]: SASL LOGIN authentication failed: authentication failure, [email protected]
show less
Brute-Force