๐บ๐ธ
mnsf
2026-10-21 20:05:20
(3 hours ago)
Too many Status 40X (13)
Brute-Force
Web App Attack
๐บ๐ธ
craudiovizai
2026-10-21 12:30:40
(11 hours ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-content/plugins/fix ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-content/plugins/fix/up.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-10-21 11:30:29
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 07:30:23.089146 2026] [security2:error] [pid 1040:tid 1040] [client 172.235.8.185:58228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kulacenterky.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kulacenterky.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "atiiT82yKK-ftFQ5ScavjgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ช๐ธ
robotstxt
2026-10-21 11:29:36
(12 hours ago)
172.235.8.185 - - [21/Oct/2026:11:28:43 +0000] "POST /wp-plain.php HTTP/1.1" 403 19678 "www.google.c ...
show more
172.235.8.185 - - [21/Oct/2026:11:28:43 +0000] "POST /wp-plain.php HTTP/1.1" 403 19678 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "-" edge="172.235.8.185"
172.235.8.185 - - [21/Oct/2026:11:28:43 +0000] "GET / HTTP/1.1" 403 62951 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "-" edge="172.235.8.185"
172.235.8.185 - - [21/Oct/2026:11:28:43 +0000] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 403 19683 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "-" edge="172.235.8.185"
172.235.8.185 - - [21/Oct/2026:11:28:43 +0000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 403 19683 "www.google.com" "Mozlila/5.0 (Linux; Android 7
...
show less
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-21 11:15:24
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 07:15:20.633732 2026] [security2:error] [pid 18381:tid 18381] [client 172.235.8.185:65182] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||36sovereignchambers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "36sovereignchambers.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "atieyNNbB-PfqGoEo8UkrgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐จ๐ญ
SOC [GOLINE SA]
2026-10-21 11:04:39
(12 hours ago)
FortiGate detected brute force login attempt from IPv4 address 172.235.8.185
Brute-Force
SSH
๐บ๐ธ
TPI-Abuse
2026-10-21 10:57:27
(12 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 06:57:22.147049 2026] [security2:error] [pid 25545:tid 25545] [client 172.235.8.185:49391] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||erikageyama.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "erikageyama.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "atiaki-xRG_6AFlOt9hKLgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐จ๐ญ
Zdenฤk Svancar
2026-10-21 10:47:10
(12 hours ago)
172.235.8.185 - - [21/Oct/2026:10:47:06 +0000] "POST /wp-plain.php HTTP/1.1" 404 548 "www.google.com ...
show more
172.235.8.185 - - [21/Oct/2026:10:47:06 +0000] "POST /wp-plain.php HTTP/1.1" 404 548 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
172.235.8.185 - - [21/Oct/2026:10:47:08 +0000] "POST /wp-plain.php HTTP/1.1" 404 548 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Port Scan
Bad Web Bot
Web App Attack
๐จ๐ญ
SOC [GOLINE SA]
2026-10-21 10:35:12
(13 hours ago)
FortiGate IPS: ALFA.TEaM.Web.Shell (severity high)
Hacking
๐บ๐ธ
factor1
2026-10-21 10:18:38
(13 hours ago)
CrowdSec at churndash Reports Abuse
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-21 10:04:04
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 06:04:00.866947 2026] [security2:error] [pid 20849:tid 20849] [client 172.235.8.185:61380] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||riccardiagency.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "riccardiagency.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "atiOEM7vKUCGLA9K6hLAWwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
4server
2026-10-21 09:45:24
(13 hours ago)
[WedOct2111:45:21.0360622026][security2:error][pid3739087:tid3739178][client172.235.8.185:0]ModSecur ...
show more
[WedOct2111:45:21.0360622026][security2:error][pid3739087:tid3739178][client172.235.8.185:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|include\|eval\|create_function\|system\|base64_decode\|decode_base64\|base64_url_decode\|str_rot13\)\\\\\\\\b\?\(\?:\\\\\\\\\(\|\\\\\\\\:\)\)\"atARGS:l.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"724\"][id\"340195\"][rev\"4\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Base64EncodedPHPfunctioninArgument-thismaybeanattack.\"][data\"php_uname\(\"][severity\"CRITICAL\"][hostname\"giuseppeasaro.com\"][uri\"/wp-plain.php\"][unique_id\"atiJsY7vbwVS8JoE23GQ8gAAAgE\"]\,referer:www.google.com
show less
Port Scan
Brute-Force
Web App Attack
๐ฉ๐ช
FeG Deutschland
2026-10-21 09:44:45
(13 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24
Exploited Host
Web App Attack
๐บ๐ธ
francelink.fr
2026-10-21 09:43:22
(13 hours ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-21T09:30:07.000Z.
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-21 09:36:15
(14 hours ago)
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210350) triggered by 172.235.8.185 (172-235-8-185.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 05:36:10.499263 2026] [security2:error] [pid 26913:tid 26913] [client 172.235.8.185:63326] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.hvacmechanalysis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.hvacmechanalysis.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "atiHik5u1zAY6pugrkkFGQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
