2026-09-20 16:06:43
(3 weeks ago)
Sensitive file access attempt
Hacking
🇩🇪
mkln.org
2026-09-18 20:29:22
(3 weeks ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-18 and 2026-09-18 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-18 and 2026-09-18 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇺🇸
TPI-Abuse
2026-09-06 10:22:49
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 06:22:44.911988 2026] [security2:error] [pid 24338:tid 24338] [client 206.232.2.168:60475] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.garantaconsulting.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.garantaconsulting.com"] [uri "/mailto:[email protected] "] [unique_id "ap0-9Ppcuqi8Vs7Nu1NfSgAAABM"], referer: http://www.garantaconsulting.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 23:19:22
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:19:15.585522 2026] [security2:error] [pid 29001:tid 29001] [client 206.232.2.168:36651] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apiu89icdbd0ZRwmB31dOQAAAAM"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 09:29:17
(2 months ago)
FortiWeb WAF: 44 attacks detected. Threat Score: 11441255. Types: Client Management(22), Signature D ...
show more
FortiWeb WAF: 44 attacks detected. Threat Score: 11441255. Types: Client Management(22), Signature Detection(22). Origin: United States.
show less
Web App Attack
2026-07-22 03:51:14
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2026-05-19 14:35:36
(4 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 17-35.206.232.2.168.web-spamme ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 17-35.206.232.2.168.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇺🇸
dtorrer
2026-05-12 17:14:53
(4 months ago)
Client attempted to submit spam on a website post.
Blog Spam
2026-04-22 13:30:00
(5 months ago)
botnet. scraping.
Brute-Force
Bad Web Bot
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-04-19 07:02:28
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 03:02:22.866426 2026] [security2:error] [pid 1698750:tid 1698750] [client 206.232.2.168:65413] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aeR9_lAeLbUaPTZrqVelwQAAAAA"], referer: http://capitalswisscorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-04-10 03:37:06
(6 months ago)
(db_admin_scan) srv101 DB admin scan 206.232.2.168 (US/United States/-): 1 in the last 3600 secs; Po ...
show more
(db_admin_scan) srv101 DB admin scan 206.232.2.168 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇦🇺
MAGIC
2026-04-01 01:32:07
(6 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇱🇻
garmtech.com
2026-03-20 15:30:30
(6 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 17-30.206.232.2.168.web-spamme ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 17-30.206.232.2.168.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇫🇷
Tilellit.PRO
2026-03-05 19:01:43
(7 months ago)
Fail2Ban banned 206.232.2.168 for security violations in jail nginx-aggressive. Log: 2026/03/05 19:0 ...
show more
Fail2Ban banned 206.232.2.168 for security violations in jail nginx-aggressive. Log: 2026/03/05 19:01:41 [crit] SSL_read() failed (SSL: error:0A00010B:SSL routines::wrong version number error:0A000139:SSL routines::record layer failure) while keepalive, client: 206.232.2.168, server: [REDACTED]
2026/03/05 19:01:43 [crit] SSL_read() failed (SSL: error:0A00010B:SSL routines::wrong version number error:0A000139:SSL routines::record layer failure) while keepalive, client: 206.232.2.168, server: [REDACTED]
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 01:15:28
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 20:15:24.759468 2026] [security2:error] [pid 20993:tid 20993] [client 206.232.2.168:33295] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aZ5NLIupddh3PzFIdTF6EQAAABM"], referer: http://www.holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
