🇳🇱
DrLex0
2026-11-02 17:10:50
UTC ·
(1 week ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
181.46.66.96 443 - [02/Nov/2026:17:10:50 +0000] "GET [redacted] HTTP/1.1" 200 7053 "[redacted]" "Mozilla/5.0 (Macintosh; Intel Mac ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
181.46.66.96 443 - [02/Nov/2026:17:10:50 +0000] "GET [redacted] HTTP/1.1" 200 7053 "[redacted]" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
show less
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-10-31 04:27:17
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 00:27:14.541778 2026] [security2:error] [pid 22299: ...
show more
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 00:27:14.541778 2026] [security2:error] [pid 22299:tid 22352] [client 181.46.66.96:33748] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sellarsmail.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sellarsmail.com"] [uri "/"] [unique_id "auVuImnZGpdvPsnz7vT_vQAAAIc"], referer: https://five.co.in/redirect.php?ref_host=laviantica.it
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 12:04:41
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 08:04:36.168507 2026] [security2:error] [pid 771:ti ...
show more
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 08:04:36.168507 2026] [security2:error] [pid 771:tid 801] [client 181.46.66.96:33752] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lawyerlouisiana.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lawyerlouisiana.com"] [uri "/"] [unique_id "auM2VBAYcCW5hF7EF85tjQAAABA"], referer: https://gmentz.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
etu brutus
2026-10-25 14:14:57
UTC ·
(2 weeks ago)
181.46.66.96 Blocked by [Attack Vector List]
...
Hacking
Brute-Force
Exploited Host
2026-10-10 00:35:12
UTC ·
(1 month ago)
Hit honeypot r.
Port Scan
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-10-08 05:47:47
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 01:47:40.968740 2026] [security2:error] [pid 7445:t ...
show more
(mod_security) mod_security (id:210350) triggered by 181.46.66.96 (cpe-181-46-66-96.telecentro-reversos.com.ar): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 01:47:40.968740 2026] [security2:error] [pid 7445:tid 7445] [client 181.46.66.96:14732] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||northwestarbor-culture.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "northwestarbor-culture.com"] [uri "/"] [unique_id "ascufHV0ArCzwJ6RSMNi1AAAAAU"], referer: https://backlinkcreation.website/dir/managed-link-building-150157
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-30 10:36:05
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
MPL
2026-09-28 18:27:33
UTC ·
(1 month ago)
tcp/22 (4 or more attempts)
Port Scan
🇺🇸
鬼影233
2026-09-28 12:14:42
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇷🇸
Scan
2026-09-26 00:58:02
UTC ·
(1 month ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
🇩🇪
milcraft.nl
2026-09-20 18:55:11
UTC ·
(1 month ago)
Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse.
DDoS Attack
Web App Attack
🇩🇪
Admins@FBN
2026-09-10 01:46:09
UTC ·
(2 months ago)
FW-PortScan: Traffic Blocked srcport=53873 dstport=22
Port Scan
Hacking
SSH
2026-09-09 18:30:32
UTC ·
(2 months ago)
Cowrie SSH honeypot: cowrie.session.connect
Brute-Force
SSH
🇺🇸
rscott.us
2026-09-08 22:00:11
UTC ·
(2 months ago)
Brute force SSH login attempts.
Brute-Force
SSH
🇺🇸
cybsecaoccol
2026-08-26 07:56:46
UTC ·
(2 months ago)
unauthorized connection or malicious port scan attempted on tcp port - corp
Port Scan
Hacking
