🇫🇮
pavel Karpenko
2026-10-26 16:11:47
(2 days ago)
190.108.77.174 - - [26/Oct/2026:19:11:47 +0300] "GET /property_lir.php?id=ru.master1&tab=overview&lang=en HTTP/1.1" 404 218 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" cl ...
show more
190.108.77.174 - - [26/Oct/2026:19:11:47 +0300] "GET /property_lir.php?id=ru.master1&tab=overview&lang=en HTTP/1.1" 404 218 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" client_port=2938 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1793031107.705
show less
DDoS Attack
🇺🇸
TPI-Abuse
2026-10-25 10:40:22
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:40:18.974433 2026] [security2:error] [pid 11088:tid ...
show more
(mod_security) mod_security (id:210350) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:40:18.974433 2026] [security2:error] [pid 11088:tid 11088] [client 190.108.77.174:5157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cbcfargo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cbcfargo.com"] [uri "/resources/promise/true_joy.pdf"] [unique_id "at3ckmapJ1uBRM0-0cdx0wAAABM"], referer: https://cbcfargo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
ALPHANET
2026-10-24 16:00:35
(4 days ago)
Botnet or web spider not respecting robots.txt
DDoS Attack
Exploited Host
🇺🇸
cwytech
2026-10-20 21:10:54
(1 week ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-20 03:58:54
(1 week ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[25]=30&topics[38]=70&topics[39]=44&topics[40]=50 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics[25]=30&topics[38]=70&topics[39]=44&topics[40]=50 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-15 01:01:44
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 21:01:37.425271 2026] [security2:error] [pid 28141:tid ...
show more
(mod_security) mod_security (id:225170) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 21:01:37.425271 2026] [security2:error] [pid 28141:tid 28141] [client 190.108.77.174:11381] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||knowyourcode.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "knowyourcode.us"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "atAl8fpej0nVmfyWE10DUwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-29 00:19:43
(4 weeks ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-25 02:24:55
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-21 20:55:18
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-20 19:28:35
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 15:28:21.433117 2026] [security2:error] [pid 5810:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 15:28:21.433117 2026] [security2:error] [pid 5810:tid 5810] [client 190.108.77.174:14524] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||weddingcapitalpartners.vittariadesign.com|F|2"] [data ".mdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "weddingcapitalpartners.vittariadesign.com"] [uri "/bak/users.mdb"] [unique_id "arAz1Snb6LT9hZUl8-5s-wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-20 17:59:42
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-15 13:51:17
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇬🇪
ORDUNET
2026-09-15 10:19:29
(1 month ago)
Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 2 ...
show more
Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 200 packets/sec for a legitimate player of that server. It was one of 8847 sources in 2396 networks and 160 countries recorded inside a single 25-minute window - the server's entire real audience is about a hundred players. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - a packet flood, so the host is most likely compromised. Evidence: [email protected] .
show less
DDoS Attack
Exploited Host
🇺🇸
TPI-Abuse
2026-09-15 01:25:10
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:24:56.655046 2026] [security2:error] [pid 28735:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 190.108.77.174 (gpon-190.108.77.174-celsiainternet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:24:56.655046 2026] [security2:error] [pid 28735:tid 28735] [client 190.108.77.174:16146] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kanata.ws|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kanata.ws"] [uri "/htdocs/backup-db.sql"] [unique_id "aqieaD73j72zVb12szUc_gAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-08-31 16:10:07
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
