🇵🇱
Budyn
2026-10-13 06:42:56
(1 day ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpv ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpvosl7k2etr0dcza06lsb9g | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/b,g,Z,E cfg/retry-mode#standard md...
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 03:45:38
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 23:44:26.956106 2026] [security2:error] [pid 11898:tid 11898] [client 185.89.110.146:65301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.hightechautoandtruck.com"] [uri "/.env.production.bak"] [unique_id "ar8ompZpCFAFz9q75q3aiQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-21 22:06:12
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 21:17:58
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 17:17:44.458476 2026] [security2:error] [pid 1425733:tid 1425733] [client 185.89.110.146:50855] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||salinabible.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "salinabible.org"] [uri "/contact"] [unique_id "ad6u-ChgSEHdpigW4m8kpQAAAAQ"], referer: https://salinabible.org/contact
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 17:01:55
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 13:01:42.397779 2026] [security2:error] [pid 3728084:tid 3728084] [client 185.89.110.146:44781] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||edgecomix.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "edgecomix.com"] [uri "/about"] [unique_id "ad5y9oxMT-1CQv7hDpPDyQAAABE"], referer: https://edgecomix.com/about
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-14 09:53:02
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 05:52:48.938281 2026] [security2:error] [pid 1769611:tid 1769611] [client 185.89.110.146:37773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dominionfinancialadvisors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dominionfinancialadvisors.com"] [uri "/financial-planning/do-i-need-a-fee-only-financial-advisor"] [unique_id "ad4OcHNvkjQtQ7NxspKk_AAAAAw"], referer: https://dominionfinancialadvisors.com/financial-planning/do-i-need-a-fee-only-financial-advisor
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-22 09:45:57
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 05:44:38.574187 2026] [security2:error] [pid 8089:tid 8089] [client 185.89.110.146:48589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.starsmogsandiego.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.starsmogsandiego.com"] [uri "/profile"] [unique_id "ab-6BgRiLY0YnvDrt4JaOQAAABs"], referer: https://www.starsmogsandiego.com/profile
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-15 14:10:05
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 185.89.110.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 15 10:09:47.844482 2026] [security2:error] [pid 11794:tid 11794] [client 185.89.110.146:35627] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tcjohnston.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tcjohnston.com"] [uri "/about/"] [unique_id "aba9q0tAyZx-ZGXjSDZCpAAAAA4"], referer: https://tcjohnston.com/about/
show less
Brute-Force
Bad Web Bot
Web App Attack
