🇸🇪
SkyDancer
2026-05-01 06:33:12
(1 month ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH
🇺🇸
NicoID
2026-05-01 00:16:47
(1 month ago)
193.202.8.147 - - [30/Apr/2026:15:49:02 -0600] "GET /wp-login.php HTTP/1.1" 200 4883 "https://www.go ...
show more
193.202.8.147 - - [30/Apr/2026:15:49:02 -0600] "GET /wp-login.php HTTP/1.1" 200 4883 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-04-29 05:08:50
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 01:08:43.233098 2026] [security2:error] [pid 21594:tid 21610] [client 193.202.8.147:41291] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||touba.newtrendmag.org|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "touba.newtrendmag.org"] [uri "/s3cmd.ini"] [unique_id "afGSW62WvhgUKuS1qzNBHQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 16:40:07
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 12:40:00.747476 2026] [security2:error] [pid 26075:tid 26075] [client 193.202.8.147:26805] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||slcflyers.com.rollinchassis.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "slcflyers.com.rollinchassis.com"] [uri "/s3cmd.ini"] [unique_id "afDi4Mjpguw2YK84WYZq4QAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ambor
2026-03-03 08:44:17
(3 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-03 07:28:27
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 02:28:22.083945 2026] [security2:error] [pid 13237:tid 13237] [client 193.202.8.147:46937] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||univey.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "univey.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaaNlgG-dcrRTkOxdquk0QAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
findlab
2025-10-01 08:00:03
(8 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-03-07 01:35:09
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 193.202.8.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 06 20:35:03.913476 2025] [security2:error] [pid 31986:tid 31986] [client 193.202.8.147:39409] [client 193.202.8.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.investorsfundingusa.com"] [uri "/.env"] [unique_id "Z8pNRzoqtTNdbRikhgGR6AAAAAA"], referer: https://tasamm.com/about/ggg167.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2024-06-09 21:23:00
(2 years ago)
DDoS Attack Layer 7 - REQUESTS / HTTP/2.0
DDoS Attack