|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 22:36:45.910518 2026] [security2:error] [pid 13267:tid 13267] [client 163.204.42.139:39294] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||criarteste.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "criarteste.com"] [uri "/"] [unique_id "ajnxPVo6WXt0uTMZc9vkxgAAAAE"], referer: http://criarteste.com/
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 15:23:25.367050 2026] [security2:error] [pid 12671:tid 12671] [client 163.204.42.139:4917] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||wplusw.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "wplusw.com"] [uri "/index.html"] [unique_id "ai7_rRboX2p6ip9EH0hvTAAAACU"], referer: http://wplusw.com/index.html
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 18:49:30.014522 2026] [security2:error] [pid 22556:tid 22556] [client 163.204.42.139:57476] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rndplumbing.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rndplumbing.com"] [uri "/"] [unique_id "ainp-peeApYDFaKCSCGpCgAAAAU"], referer: http://rndplumbing.com/
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 163.204.42.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 19:09:26.900957 2026] [security2:error] [pid 25552:tid 25552] [client 163.204.42.139:47045] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||xpengineering.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "xpengineering.com"] [uri "/"] [unique_id "aiNXJl9MtNzCaBhXNW3m_gAAAAw"], referer: http://xpengineering.com/
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
RAP
|
|
2024-08-01 22:54:51 UTC Unauthorized activity to TCP port 23. Telnet
|
Port Scan
|
|
|
🇦🇹
urnilxfgbez
|
|
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
|
Port Scan
|
|
|
🇸🇮
Alexandr Kulkov
|
|
163.204.42.139 triggered Icarus honeypot on port 23.
|
Port Scan
Hacking
|
|
|
🇩🇪
KPS
|
|
PortscanM
|
Port Scan
|
|
|
🇺🇸
cybsecaoccol
|
|
unauthorized connection or malicious port scan attempted on tcp port - corp
|
Port Scan
Hacking
|
|
|
🇺🇸
RAP
|
|
2024-08-01 19:31:08 UTC Unauthorized activity to TCP port 23. Telnet
|
Port Scan
|
|
|
🇿🇦
IrisFlower
|
|
Unauthorized connection attempt detected from IP address 163.204.42.139 to port 2323 [J]
|
Port Scan
Hacking
|
|
|
🇿🇦
IrisFlower
|
|
Unauthorized connection attempt detected from IP address 163.204.42.139 to port 23 [J]
|
Port Scan
Hacking
|
|