🇵🇱
Budyn
2026-10-11 13:21:45
(5 days ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpv ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpvosl7k2etr0dcza06lsb9g | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/b,E,g,Z cfg/retry-mode#standard md...
show less
Hacking
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-06 14:32:39
(1 week ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 191.102.129.152 - - [06/Oct/2026:16:32:25 +0200] "GET /.git/HEAD HTTP/1.1" 301 6335 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
...
show less
Bad Web Bot
Web App Attack
2026-09-29 04:54:39
(2 weeks ago)
[da.kdns.gr] httpd-config-scan: sites=www.esa.gr; logs=/var/log/httpd/domains/esa.gr.log; samples=/. ...
show more
[da.kdns.gr] httpd-config-scan: sites=www.esa.gr; logs=/var/log/httpd/domains/esa.gr.log; samples=/.git/HEAD
show less
Hacking
Web App Attack
🇮🇩
hermawan
2026-09-20 03:17:55
(3 weeks ago)
[Sun Sep 20 10:17:36.171995 2026] [security2:error] [pid 279869:tid 140496768857792] [client 191.102 ...
show more
[Sun Sep 20 10:17:36.171995 2026] [security2:error] [pid 279869:tid 140496768857792] [client 191.102.129.152:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "62341464827" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "107"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: 62341464827 found within REQUEST_FILENAME: /tel:+62341464827 request_line = HEAD /tel:+62341464827 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/tel:+62341464827"] [unique_id "aq9QUOOpLG8fdwvl4nhPqgAAAoE"], referer https://staklim-jatim.bmkg.go.id [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[279930] [YU07k+GEVQs] [aq9QUOOpLG8fdwvl4nhPqgAAAoE] keep_alive=[0] [2026-09-20 10:17:36.171999] [R:aq9QUOOpLG8fdwvl4nhPqgAAAoE] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36' Host:'stakli
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-09-16 11:48:01
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 07:47:56.640917 2026] [security2:error] [pid 17342:tid 17342] [client 191.102.129.152:32911] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aqqB7IFrw_amus-6DxSjSQAAACE"], referer: http://HOLGERFELD.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 04:48:20
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 00:48:09.045980 2026] [security2:error] [pid 20735:tid 20735] [client 191.102.129.152:34745] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apeqiUHVf0piXqcUvVvItwAAABw"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-19 10:20:17
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 06:20:12.819089 2026] [security2:error] [pid 14904:tid 14904] [client 191.102.129.152:45651] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||HOLGERFELD.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aoWDXJkxerYU-cvNHFctCAAAAAs"], referer: http://HOLGERFELD.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 10:17:20
(2 months ago)
FortiWeb WAF: 28 attacks detected. Threat Score: 11181230. Types: Client Management(14), Signature D ...
show more
FortiWeb WAF: 28 attacks detected. Threat Score: 11181230. Types: Client Management(14), Signature Detection(14). Origin: United States.
show less
Web App Attack
🇺🇸
dtorrer
2026-06-04 02:55:07
(4 months ago)
Client attempted to submit spam on a website post.
Blog Spam
🇺🇸
TPI-Abuse
2026-03-30 14:36:45
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 10:36:36.393540 2026] [security2:error] [pid 1114:tid 1114] [client 191.102.129.152:42929] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "acqKdClZ44CUsSxqARS5hAAAABk"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-23 09:32:59
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 04:32:54.347420 2026] [security2:error] [pid 13514:tid 13514] [client 191.102.129.152:60433] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aZwexuaSZJpp7lDdXszoogAAAA8"], referer: http://www.capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-02-21 09:46:45
(7 months ago)
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 152.129.102.191.rbl.mal ...
show more
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 152.129.102.191.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-mnz6-3)
show less
Hacking
2026-02-10 03:33:19
(8 months ago)
Malicious activity detected
Hacking
Web App Attack
🇦🇺
MAGIC
2026-02-09 00:11:26
(8 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2026-02-07 05:42:44
(8 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack