🇺🇸
TPI-Abuse
2026-11-11 15:26:19
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 10:26:14.712987 2026] [security2:error] [pid 26910:tid 26910] [client 206.232.2.59:28259] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 10:26:14.712987 2026] [security2:error] [pid 26910:tid 26910] [client 206.232.2.59:28259] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unityhealthpharmaceutical.com"] [uri "/.git/HEAD"] [unique_id "avSJFjcfYywx27QzMXv_UAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
throny
2026-11-05 21:06:12
UTC ·
(1 week ago)
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-05 21:03 UTC, API call GetSendQuota, client aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-202-generic md/arch#x86_64 lang/python#3.13.11 md/p ...
show more
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-05 21:03 UTC, API call GetSendQuota, client aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-202-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython
show less
Hacking
Web App Attack
🇩🇪
altenglaner
2026-10-20 07:14:25
UTC ·
(3 weeks ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-13 00:53:26
UTC ·
(1 month ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpvosl7k2etr0dcza06lsb9g | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl# ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_3 | Action: AWS API Call | Token: 4tpvosl7k2etr0dcza06lsb9g | Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/Z,b,E,g cfg/retry-mode#standard md...
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 08:01:07
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:01:02.392893 2026] [security2:error] [pid 4980:tid 4980] [client 206.232.2.59:53577] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 04:01:02.392893 2026] [security2:error] [pid 4980:tid 4980] [client 206.232.2.59:53577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kelvinlouie.com"] [uri "/.git/HEAD"] [unique_id "asyTvp63ylCh39LT6J4PnQAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-22 03:42:39
UTC ·
(3 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 14:38:52
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 10:38:46.175476 2026] [security2:error] [pid 22734:tid 22734] [client 206.232.2.59:26835] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 10:38:46.175476 2026] [security2:error] [pid 22734:tid 22734] [client 206.232.2.59:26835] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cartiologyfilms.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cartiologyfilms.com"] [uri "/about-us"] [unique_id "ac_Q9re70SRTmAStp9gMogAAAAA"], referer: https://cartiologyfilms.com/about-us
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 00:19:45
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 20:19:33.912737 2026] [security2:error] [pid 30646:tid 30681] [client 206.232.2.59:53483] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 20:19:33.912737 2026] [security2:error] [pid 30646:tid 30681] [client 206.232.2.59:53483] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jd-web-designs.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jd-web-designs.com"] [uri "/contact-us"] [unique_id "acnBlRswgW2DXuDiAlW8hAAAAZg"], referer: https://jd-web-designs.com/contact-us
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-28 22:48:33
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 18:48:24.340649 2026] [security2:error] [pid 7561:tid 7586] [client 206.232.2.59:33815] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 28 18:48:24.340649 2026] [security2:error] [pid 7561:tid 7586] [client 206.232.2.59:33815] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||slelectric.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "slelectric.com"] [uri "/who-we-are"] [unique_id "achauAVxQ3RGYUjTpA0-cwAAAcQ"], referer: https://slelectric.com/who-we-are
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-18 05:02:44
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 18 01:02:32.751291 2026] [security2:error] [pid 12681:tid 12681] [client 206.232.2.59:37037] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 18 01:02:32.751291 2026] [security2:error] [pid 12681:tid 12681] [client 206.232.2.59:37037] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||indyham.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "indyham.com"] [uri "/about"] [unique_id "abox6GBm9iT8n4sh6lZUHwAAAA0"], referer: https://indyham.com/about
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-17 19:47:38
UTC ·
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 15:47:16.424632 2026] [security2:error] [pid 30978:tid 30978] [client 206.232.2.59:35617] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 15:47:16.424632 2026] [security2:error] [pid 30978:tid 30978] [client 206.232.2.59:35617] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||chicagowca.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "chicagowca.com"] [uri "/profile"] [unique_id "abmvxOX3-G5119wea8IN4gAAAAk"], referer: https://chicagowca.com/profile
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-04 15:15:38
UTC ·
(8 months ago)
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 10:15:33.763949 2026] [security2:error] [pid 14462:tid 14462] [client 206.232.2.59:42363] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 206.232.2.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 10:15:33.763949 2026] [security2:error] [pid 14462:tid 14462] [client 206.232.2.59:42363] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bewdleypizza.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bewdleypizza.com"] [uri "/our-story"] [unique_id "aahMlXE4tVsk0aPl6ki6-AAAABA"], referer: https://bewdleypizza.com/our-story
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
HandyTreff.de
2026-02-18 14:36:27
UTC ·
(8 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -47.987 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mo
Web App Attack
Bad Web Bot
🇺🇸
Psycho Solutions LLC
2025-04-17 13:14:59
UTC ·
(1 year ago)
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 4/17/2025 1:14 pm (UTC-6)
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇮🇩
BPS-StatisticsIndonesia
2025-04-06 16:21:46
UTC ·
(1 year ago)
WP Login Scan Activities
Web App Attack
