🇩🇪
mkln.org
2026-09-17 22:48:29
(3 weeks ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-17 and 2026-09-17 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-17 and 2026-09-17 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇩🇪
Bedios GmbH
2026-09-16 02:58:46
(3 weeks ago)
Login credentials theft attempt
Hacking
🇺🇸
TPI-Abuse
2026-09-06 23:05:08
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 19:05:04.242576 2026] [security2:error] [pid 8837:tid 8837] [client 204.217.131.143:47869] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||americanexportimport.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "americanexportimport.com"] [uri "/mailto:[email protected] "] [unique_id "ap3xoP9YCifR04Ur5MVZZAAAAAY"], referer: http://americanexportimport.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-03 15:05:32
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 11:05:24.280429 2026] [security2:error] [pid 30866:tid 30866] [client 204.217.131.143:46437] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apmMtKgot6LgTKC_sqdd7gAAACY"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 10:28:05
(2 months ago)
FortiWeb WAF: 22 attacks detected. Threat Score: 11113405. Types: Client Management(11), Signature D ...
show more
FortiWeb WAF: 22 attacks detected. Threat Score: 11113405. Types: Client Management(11), Signature Detection(11). Origin: United States.
show less
Web App Attack
2026-07-22 02:57:00
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2026-06-21 06:54:25
(3 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-54.204.217.131.143.web-spam ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-54.204.217.131.143.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 05:32:27
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 01:32:21.675846 2026] [security2:error] [pid 3908:tid 3908] [client 204.217.131.143:27837] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aiJfZeBhC2y_dQ78JAWwPAAAABE"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
gnom4ik
2026-02-22 07:33:13
(7 months ago)
ban-reviewer auto report; ip=204.217.131.143; scenario=http:scan; verdict=valid_ban; confidence=0.85 ...
show more
ban-reviewer auto report; ip=204.217.131.143; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for HTTP scanning activity (scenario: http:scan); Appears in abuseipdb categories related to port scanning and hacking; Decision made within a short time window indicating immediate threat detection
show less
Port Scan
Hacking
Brute-Force
🇨🇭
backslash
2026-02-20 09:30:03
(7 months ago)
SQL Injection
🇺🇸
TPI-Abuse
2026-02-15 10:10:43
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 05:10:36.341413 2026] [security2:error] [pid 8229:tid 8229] [client 204.217.131.143:54965] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aZGbnHrCnEf6vysq5ka4kwAAABE"], referer: http://capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2026-01-20 02:09:51
(8 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-03 03:31:12
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 02 22:31:05.335042 2026] [security2:error] [pid 9032:tid 9032] [client 204.217.131.143:55825] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aViNedYSSX4qmtiAemdg2QAAAAM"], referer: http://capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2025-12-05 06:41:26
(10 months ago)
Critical web app attack detected. Illegal Accept header: charset parameter
Web App Attack
🇧🇪
voormedia
2025-04-15 22:43:59
(1 year ago)
Accessed trap at '/wp-login.php'
Web App Attack
