🇳🇱
Savvii
2026-10-27 11:08:27
(1 day ago)
26 attempts against mh-modsecurity-ban on lunar
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-27 04:44:15
(1 day ago)
28 attempts against mh-modsecurity-ban on lunar
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-26 22:47:59
(1 day ago)
25 attempts against mh-modsecurity-ban on lunar
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-26 04:34:09
(2 days ago)
15 attempts against mh-modsecurity-ban on lunar
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 23:54:48
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 19:54:40.590241 2026] [security2:error] [pid 7662:tid 7662] [client 204.217.131.179:39895] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "atlQwAHLQxx5-ISH-nBdEwAAAFc"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-13 08:09:56
(2 weeks ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_12 | Action: AWS API Call | Token: akf ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_12 | Action: AWS API Call | Token: akf9s74n5eldbzbpzbzf5lt45 | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/Z,b,E,g cfg/retry-mode#standard md...
show less
Hacking
Bad Web Bot
Web App Attack
🇬🇧
CrystalMaker
2026-10-08 19:32:30
(2 weeks ago)
Vulnerability scan - GET /.git/info/refs
Hacking
🇩🇪
LRob
2026-09-21 19:19:23
(1 month ago)
This address sent web requests that have no legitimate reading: known exploit paths, path traversal, ...
show more
This address sent web requests that have no legitimate reading: known exploit paths, path traversal, injected payloads, or the signature of a vulnerability scanner. This is an attack on the sites we host, blocked on sight. Please check the machine behind it for an attack tool or malware. | method: GET | path: /mailto:[email protected] | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36 | 2026-09-21 19:19 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-19 03:31:29
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 23:31:22.955495 2026] [security2:error] [pid 12220:tid 12220] [client 204.217.131.179:40017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "budgetbyron.com"] [uri "/.git/HEAD"] [unique_id "aq4CCoTx74hzbusH_MbJDQAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-16 17:55:27
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 13:55:19.881321 2026] [security2:error] [pid 9368:tid 9368] [client 204.217.131.179:31071] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bernabeu.org"] [uri "/.git/HEAD"] [unique_id "aqrYByA_d-Yc9P7Hfuq5jwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dtorrer
2026-09-08 19:46:54
(1 month ago)
Client attempted to submit spam on a website post.
Blog Spam
🇺🇸
TPI-Abuse
2026-08-27 17:09:09
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 204.217.131.179 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 13:09:00.951931 2026] [security2:error] [pid 29063:tid 29063] [client 204.217.131.179:48939] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "apBvLExwEjbz7xAFPRT26QAAAAY"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-07 19:33:43
(2 months ago)
Web application attack detected.
Web App Attack
2026-08-04 09:53:05
(2 months ago)
FortiWeb WAF: 8 attacks detected. Threat Score: 11319455. Types: Client Management(4), Signature Det ...
show more
FortiWeb WAF: 8 attacks detected. Threat Score: 11319455. Types: Client Management(4), Signature Detection(4). Origin: United States.
show less
Web App Attack
2026-07-22 00:41:39
(3 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
