🇵🇱
Budyn
2026-10-05 10:22:06
(6 days ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_5 | Action: AWS API Call | Token: oivi ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_5 | Action: AWS API Call | Token: oivim5afqu4p15ffms5ex4pv4 | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/g,E,b,Z cfg/retry-mode#standard md...
show less
Hacking
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-02 04:12:55
(1 week ago)
[cb-09al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-09al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 206.232.2.251 - - [02/Oct/2026:06:12:27 +0200] "GET /.git/HEAD HTTP/1.1" 301 4496 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
...
show less
Bad Web Bot
Web App Attack
2026-09-27 04:31:40
(2 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
mkln.org
2026-09-20 12:56:50
(3 weeks ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇩🇪
big-cloud.nl
2026-09-20 11:04:02
(3 weeks ago)
Try to access /.git/HEAD
Web App Attack
🇮🇩
hermawan
2026-09-20 01:25:12
(3 weeks ago)
[Sun Sep 20 08:25:11.523337 2026] [security2:error] [pid 235559:tid 140495141459648] [client 206.232 ...
show more
[Sun Sep 20 08:25:11.523337 2026] [security2:error] [pid 235559:tid 140495141459648] [client 206.232.2.251:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "62341461595" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "107"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: 62341461595 found within REQUEST_FILENAME: /tel:+62341461595 request_line = HEAD /tel:+62341461595 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/tel:+62341461595"] [unique_id "aq81989KGS8iDFFwUcbEAQAAANg"], referer https://staklim-jatim.bmkg.go.id [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[235610] [hSA4ASCrVw8] [aq81989KGS8iDFFwUcbEAQAAANg] keep_alive=[0] [2026-09-20 08:25:11.523342] [R:aq81989KGS8iDFFwUcbEAQAAANg] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36' Host:'staklim-
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-09-19 09:43:16
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 05:41:24.794281 2026] [security2:error] [pid 1438:tid 1438] [client 206.232.2.251:31011] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.hg/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.newlife.org.au"] [uri "/.hg/store"] [unique_id "aq5YxPYFpQEwjL-AOJtltAAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-11 15:08:27
(1 month ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: HEAD | path: ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: HEAD | path: /mailto:[email protected] | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 | 2026-09-11 15:08 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 10:28:22
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 06:28:15.310649 2026] [security2:error] [pid 7011:tid 7011] [client 206.232.2.251:58781] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apf6P0-ay8nAPXKlt7mq3QAAAA4"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:04:11
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.2.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:04:04.772123 2026] [security2:error] [pid 10181:tid 10181] [client 206.232.2.251:39797] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.customhumanrobots.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.customhumanrobots.com"] [uri "/mailto:[email protected] "] [unique_id "apBf9CveBhnjK08xxt2TeQAAABc"], referer: https://www.customhumanrobots.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 10:16:13
(2 months ago)
FortiWeb WAF: 28 attacks detected. Threat Score: 11186780. Types: Client Management(14), Signature D ...
show more
FortiWeb WAF: 28 attacks detected. Threat Score: 11186780. Types: Client Management(14), Signature Detection(14). Origin: United States.
show less
Web App Attack
🇩🇪
FD-IX
2026-08-01 12:16:58
(2 months ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
2026-07-22 03:51:02
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇫🇷
Tilellit.PRO
2026-06-08 19:45:55
(4 months ago)
Fail2Ban banned 206.232.2.251 for security violations in jail nginx-aggressive. Log: 2026/06/08 19:4 ...
show more
Fail2Ban banned 206.232.2.251 for security violations in jail nginx-aggressive. Log: 2026/06/08 19:45:50 [crit] SSL_read() failed (SSL: error:0A00010B:SSL routines::wrong version number error:0A000139:SSL routines::record layer failure) while keepalive, client: 206.232.2.251, server: [REDACTED]
2026/06/08 19:45:54 [crit] SSL_read() failed (SSL: error:0A00010B:SSL routines::wrong version number error:0A000139:SSL routines::record layer failure) while keepalive, client: 206.232.2.251, server: [REDACTED]
...
show less
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-05-22 16:21:36
(4 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-21.206.232.2.251.web-spamme ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-21.206.232.2.251.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
