🇩🇪
updown.io
2026-11-14 00:36:41
UTC ·
(5 hours ago)
{"level":"info","ts":1794616601.4936485,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"162.158.111.243","remote_port":"13843","client_ip":"162.158.111.243","proto":"HTTP/1.1","method":"GET","host":"status.dreamsis.com ...
show more
{"level":"info","ts":1794616601.4936485,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"162.158.111.243","remote_port":"13843","client_ip":"162.158.111.243","proto":"HTTP/1.1","method":"GET","host":"status.dreamsis.com","uri":"/300_n.php","headers":{"X-Forwarded-For":["9.141.30.218"],"Cdn-Loop":["cloudflare; loops=1"],"Cf-Connecting-Ip":["9.141.30.218"],"X-Forwarded-Proto":["https"],"Connection":["Keep-Alive"],"Cf-Ray":["a5a1f17f48ca362b-FRA"],"Cf-Ipcountry":["DE"],"Accept-Encoding":["gzip, br"],"Cf-Visitor":["{\"scheme\":\"https\"}"]}},"bytes_read":0,"user_id":"","duration":0.000174603,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://status.dreamsis.com/300_n.php"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1794616601.5452368,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"162.158.111.243","remote_port":"13851","client_ip":"162.158.111.243","proto":"HTTP/1.1","method":"GET
...
show less
DDoS Attack
Web App Attack
🇧🇪
madeit
2026-11-11 01:53:17
UTC ·
(3 days ago)
Web App Attack
🇫🇷
rellik
2026-11-06 21:46:00
UTC ·
(1 week ago)
Scanning Critical File, Potential Part of BotNet
Hacking
DDoS Attack
Web App Attack
🇺🇸
craudiovizai
2026-10-26 06:30:42
UTC ·
(2 weeks ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
Web App Attack
Bad Web Bot
🇧🇪
madeit
2026-10-22 01:41:40
UTC ·
(3 weeks ago)
Web App Attack
🇫🇷
dynamix
2026-10-21 07:35:40
UTC ·
(3 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:37:02
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:36:55.838161 2026] [security2:error] [pid 26905:tid 26905] [client 162.158.111.243:1122 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:36:55.838161 2026] [security2:error] [pid 26905:tid 26905] [client 162.158.111.243:11223] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||modestosoftwater.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "modestosoftwater.com"] [uri "/database.sql"] [unique_id "atS9Z1f1oOxbxS8QbGRx7AAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:23:39
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:23:33.298833 2026] [security2:error] [pid 19149:tid 19149] [client 162.158.111.243:1031 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:23:33.298833 2026] [security2:error] [pid 19149:tid 19149] [client 162.158.111.243:10312] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||koshland.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "koshland.com"] [uri "/config.php.bak"] [unique_id "atSQFa8X_8XkhEn8RHQlhQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:50:32
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:50:25.396879 2026] [security2:error] [pid 11859:tid 11859] [client 162.158.111.243:1426 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:50:25.396879 2026] [security2:error] [pid 11859:tid 11859] [client 162.158.111.243:14265] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||desertalfas.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "desertalfas.org"] [uri "/config.php.bak"] [unique_id "atQz8di5lyNwXhjzBWlmVgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:29:57
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:29:51.214687 2026] [security2:error] [pid 10155:tid 10155] [client 162.158.111.243:9589 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:29:51.214687 2026] [security2:error] [pid 10155:tid 10155] [client 162.158.111.243:9589] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rwcartoons.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rwcartoons.com"] [uri "/config.php.bak"] [unique_id "atQvH-u_s1Mnt-VkCaLgrwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:00:40
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:00:31.267783 2026] [security2:error] [pid 25144:tid 25144] [client 162.158.111.243:1241 ...
show more
(mod_security) mod_security (id:210730) triggered by 162.158.111.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:00:31.267783 2026] [security2:error] [pid 25144:tid 25144] [client 162.158.111.243:12416] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.somehand.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.somehand.com"] [uri "/database.sql"] [unique_id "atPT3yksjqziUH7C-o8kFwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-05 13:48:39
UTC ·
(1 month ago)
Web App Attack
🇷🇺
DZBOT
2026-09-08 01:24:00
UTC ·
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇩🇪
reznekcs
2026-08-11 05:01:13
UTC ·
(3 months ago)
Blocked by UFW firewall
Brute-Force
🇷🇺
DZBOT
2026-08-07 12:34:44
UTC ·
(3 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
