🇩🇪
EGP Abuse Dept
2026-11-07 14:22:50
UTC ·
(1 hour ago)
Scanning for web/db/file exploits on tpc-014.mach3builders.nl
SQL Injection
Bad Web Bot
Web App Attack
🇬🇧
Bytemark
2026-10-15 04:24:23
UTC ·
(3 weeks ago)
193.238.193.255 - - [15/Oct/2026:05:24:23 +0100] "GET /sitemap.xml HTTP/1.1" 301 6834 "-" "SemrushBot-EO"
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 01:50:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:211190) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 21:50:17.027349 2026] [security2:error] [pid 15773:tid 15790] [client 193.238.193.255:4079 ...
show more
(mod_security) mod_security (id:211190) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 21:50:17.027349 2026] [security2:error] [pid 15773:tid 15790] [client 193.238.193.255:40793] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?p=%3C%3Fxml+version%3D%221.0%22%3F%3E%3C%21DOCTYPE+foo+%5B%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E%5D%3E%3Cfoo%3E%26xxe%3B%3C%2Ffoo%3E"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.com"] [uri "/"] [unique_id "ar28Wd4K4QdkoZ_I74ECZwAAAIY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-03 06:22:11
UTC ·
(2 months ago)
[03/Sep/2026:09:22:10 +0300] -- 193.238.193.255 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/uploads/sites/58/2018/11/39-14.pdf HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 18:16:33
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 14:16:27.145484 2026] [security2:error] [pid 348907:tid 349858] [client 193.238.193.255:38 ...
show more
(mod_security) mod_security (id:210492) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 14:16:27.145484 2026] [security2:error] [pid 348907:tid 349858] [client 193.238.193.255:38159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.com"] [uri "/wp-config.php~"] [unique_id "apcWe87YnBQdIzhC52WHkAAABFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 04:02:19
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 00:02:12.695597 2026] [security2:error] [pid 24244:tid 24266] [client 193.238.193.255:3505 ...
show more
(mod_security) mod_security (id:210730) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 00:02:12.695597 2026] [security2:error] [pid 24244:tid 24266] [client 193.238.193.255:35051] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.com"] [uri "/header.php.bak"] [unique_id "akXixMVqafY74aTf9-BODwAAAkA"], referer: https://www.kettlehill.com/header.php.bak
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
securejdprop
2026-06-13 22:59:46
UTC ·
(4 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 193.238.193.255 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-13 22:59:45.719443639 +0000 UTC
Hacking
Web App Attack
🇸🇬
securejdprop
2026-06-11 15:38:59
UTC ·
(4 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 193.238.193.255 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-11 15:38:58.413344239 +0000 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 02:03:15
UTC ·
(5 months ago)
(mod_security) mod_security (id:210350) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 22:01:46.633424 2026] [security2:error] [pid 17655:tid 17763] [client 193.238.193.255:4444 ...
show more
(mod_security) mod_security (id:210350) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 22:01:46.633424 2026] [security2:error] [pid 17655:tid 17763] [client 193.238.193.255:44443] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.staging.kettlehill.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.staging.kettlehill.com"] [uri "/"] [unique_id "ahzoCsKV5JcfxL4sumlDfAAAAQ0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
securejdprop
2026-05-15 16:19:20
UTC ·
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 193.238.193.255 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-05-15 16:19:19.525183997 +0000 UTC
Hacking
Web App Attack
🇸🇬
securejdprop
2026-02-25 12:10:26
UTC ·
(8 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻). Ip 193.238.193.255 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-02-25 12:10:25.215610684 +0000 UTC
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 09:14:57
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 05:14:55.217921 2025] [security2:error] [pid 3904812:tid 3904979] [client 193.238.193.255: ...
show more
(mod_security) mod_security (id:210730) triggered by 193.238.193.255 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 05:14:55.217921 2025] [security2:error] [pid 3904812:tid 3904979] [client 193.238.193.255:45505] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kettlehill.kettlehill.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kettlehill.kettlehill.com"] [uri "/main.php.bak"] [unique_id "aIyFj-ifMJM5rDs5cas6PwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-08 22:52:31
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-07-01 23:45:38
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-07-01 22:58:40
UTC ·
(1 year ago)
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
Brute-Force
SSH
