🇺🇸
decode5921
2026-10-25 12:12:09
(1 day ago)
Honeypot hit: GET /keep-records/ (tool: Disguised as a browser)
Bad Web Bot
Web App Attack
🇺🇸
dharmachef
2026-10-25 05:32:07
(1 day ago)
2026-10-25T05:31:36+00:00: HTTP vulnerability scan rejected. Recognized signature: WordPress file or ...
show more
2026-10-25T05:31:36+00:00: HTTP vulnerability scan rejected. Recognized signature: WordPress file or login probe. Source IP: 199.115.177.144.
show less
Port Scan
2026-10-24 09:12:21
(2 days ago)
GET / | rule: automated-client-blocked | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 ...
show more
GET / | rule: automated-client-blocked | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3 | net: Flux Telecom, LLC AS6079
show less
Bad Web Bot
2026-10-23 07:57:50
(3 days ago)
GET / | rule: automated-client-blocked | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 ...
show more
GET / | rule: automated-client-blocked | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3
show less
Bad Web Bot
🇩🇪
LRob
2026-10-22 12:07:39
(4 days ago)
Not following 301 redirects — wasted requests | host: onetahiti.com | method: GET | path: / | ua: Mo ...
show more
Not following 301 redirects — wasted requests | host: onetahiti.com | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3 | src_port: 39281 | 2026-10-22 12:07 UTC
show less
Bad Web Bot
🇺🇸
decode5921
2026-10-22 03:55:44
(4 days ago)
Honeypot hit: GET /keep-records/
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-10-18 07:18:29
(1 week ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT ...
show more
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-16 07:09:50
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 03:09:44.230929 2026] [security2:error] [pid 16915:tid 16915] [client 199.115.177.144:41335] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||laurendritz.net|F|4"] [data "GET ?c=d;o=a HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "laurendritz.net"] [uri "/"] [unique_id "atHNuOah_fkSjTpZJxqvwgAAAA4"], referer: https://laurendritz.net?c=s;o=a
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-16 01:54:21
(1 week ago)
Web application attack detected.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 22:46:54
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 18:46:48.212794 2026] [security2:error] [pid 3953:tid 3953] [client 199.115.177.144:40479] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bwill4428.com|F|4"] [data "GET ?c=s;o=a HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bwill4428.com"] [uri "/"] [unique_id "atFX2O6R1b0sB0dki_u61gAAAAg"], referer: https://bwill4428.com?c=m;o=a
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:00:07
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:00:01.392081 2026] [security2:error] [pid 24528:tid 24528] [client 199.115.177.144:57485] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||bayoutown.net|F|4"] [data "GET ?c=s;o=a HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bayoutown.net"] [uri "/"] [unique_id "as638ZfW2Z0BhYWX-PmvSgAAAAc"], referer: https://bayoutown.net?c=m;o=a
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-10-13 16:37:20
(1 week ago)
fail2ban-ban
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TIScore
2026-10-13 07:56:42
(1 week ago)
Automated web attack / probing. Signals: Unexpected path. Last path: /wp-sitemap.xml
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 22:46:41
(1 week ago)
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:217210) triggered by 199.115.177.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 18:46:35.962868 2026] [security2:error] [pid 8739:tid 8739] [client 199.115.177.144:34215] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||rocktailsshow.com|F|4"] [data "GET ?c=n;o=d HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rocktailsshow.com"] [uri "/"] [unique_id "as1jSyK6NnROSN0OP9MczwAAAAA"], referer: https://rocktailsshow.com/wp-sitemap.xml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-12 15:08:03
(2 weeks ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT ...
show more
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3 | 2026-10-12 15:08 UTC
show less
Bad Web Bot
