🇩🇪
big-cloud.nl
2026-11-11 08:17:05
UTC ·
(1 day ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:48:24
UTC ·
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:48:20.260375 2026] [security2:error] [pid 24460:tid 24460] [client 196.41.210.187:44414] ...
show more
(mod_security) mod_security (id:225170) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:48:20.260375 2026] [security2:error] [pid 24460:tid 24460] [client 196.41.210.187:44414] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||67ronin.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "67ronin.com"] [uri "/wp-json/wp/v2/users"] [unique_id "avL2dHw1lNM8TUjrXA-k8gAAAAE"], referer: http://67ronin.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
justbible
2026-11-09 15:49:57
UTC ·
(3 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 9 requests from 2026-11-09T15:49:57+00:00 to 2026-11-11T01:52:06+00:00, e.g. 'GET /en/kjv,bbe,bsb,asv/esth/1/2 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64) Appl ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 9 requests from 2026-11-09T15:49:57+00:00 to 2026-11-11T01:52:06+00:00, e.g. 'GET /en/kjv,bbe,bsb,asv/esth/1/2 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
2026-11-03 23:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /communications/shopby/manufacturer-polycom-lifesize-aastra-audiocodes-snom-netgear-crestron-bosch-beyerdynamic-rcf-bxb-fortinet-huawei.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
鬼影233
2026-10-30 06:09:31
UTC ·
(1 week ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-27 23:21:08
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:21:03.964876 2026] [security2:error] [pid 26895:tid 26895] [client 196.41.210.187:34870] ...
show more
(mod_security) mod_security (id:210730) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:21:03.964876 2026] [security2:error] [pid 26895:tid 26895] [client 196.41.210.187:34870] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cameronsol.com|F|2"] [data ".texasbordertours.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cameronsol.com"] [uri "/www.texasbordertours.com"] [unique_id "auEx3zxvnfetrthkUUEd2wAAAAE"], referer: https://www.cameronsol.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-23 06:07:01
UTC ·
(2 weeks ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇲🇹
Malta
2026-10-19 01:14:19
UTC ·
(3 weeks ago)
196.41.210.187 - - [19/Oct/2026:03:14:19 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇩🇪
FeG Deutschland
2026-10-15 02:39:44
UTC ·
(4 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24
Exploited Host
Web App Attack
2026-10-13 10:47:36
UTC ·
(4 weeks ago)
WordPress Brute Force
Brute-Force
🇲🇹
Malta
2026-10-09 08:40:17
UTC ·
(1 month ago)
196.41.210.187 - - [09/Oct/2026:10:40:17 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
Brute-force password attempt
Hacking
Web App Attack
Brute-Force
🇩🇪
FeG Deutschland
2026-10-08 19:00:49
UTC ·
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 17:24:57
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 13:24:54.123129 2026] [security2:error] [pid 9833:tid 9833] [client 196.41.210.187:52782] M ...
show more
(mod_security) mod_security (id:210350) triggered by 196.41.210.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 13:24:54.123129 2026] [security2:error] [pid 9833:tid 9833] [client 196.41.210.187:52782] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||qavideo.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "qavideo.com"] [uri "/"] [unique_id "ar6XZv2uDHPHrdx3HcrQjAAAAAk"], referer: https://websitebacklinkgenerator.space/dir/trusted-seo-backlinks-169604
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-01 15:12:49
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 09:42:07
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
