🇫🇷
j-tap
2026-10-07 15:28:23
(4 days ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
2026-09-25 11:00:00
(2 weeks ago)
botnet
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
Hacking
🇩🇪
mkln.org
2026-09-19 23:39:00
(3 weeks ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-19 and 2026-09-19 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-19 and 2026-09-19 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇺🇸
TPI-Abuse
2026-09-16 12:41:16
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 08:41:11.968681 2026] [security2:error] [pid 28414:tid 28414] [client 206.232.3.54:48519] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "behrooz.org"] [uri "/.git/HEAD"] [unique_id "aqqOZwu2gxGB_P_iMm2afwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-02 02:15:15
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 22:15:03.115434 2026] [security2:error] [pid 25542:tid 25542] [client 206.232.3.54:50117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||capitalswisscorp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "apeGp9dw59a8EaWTPGMOawAAABI"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 09:22:11
(2 months ago)
FortiWeb WAF: 24 attacks detected. Threat Score: 11474330. Types: Client Management(12), Signature D ...
show more
FortiWeb WAF: 24 attacks detected. Threat Score: 11474330. Types: Client Management(12), Signature Detection(12). Origin: United States.
show less
Web App Attack
🇱🇻
garmtech.com
2026-08-04 08:50:26
(2 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 11-50.206.232.3.54.web-spammer ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 11-50.206.232.3.54.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
2026-07-22 01:56:56
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2026-07-07 00:53:38
(3 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 03-53.206.232.3.54.web-spammer ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 03-53.206.232.3.54.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇱🇻
garmtech.com
2026-06-20 10:54:47
(3 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 13-54.206.232.3.54.web-spammer ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 13-54.206.232.3.54.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇬🇧
Steve
2026-06-03 20:25:05
(4 months ago)
Forum Spam
Web Spam
🇪🇸
robotstxt
2026-05-24 12:10:02
(4 months ago)
206.232.3.54 - - [24/May/2026:12:09:37 +0000] "GET /mailto:[email protected] HTTP/1.1" 404 43141 "https:/ ...
show more
206.232.3.54 - - [24/May/2026:12:09:37 +0000] "GET /mailto:[email protected] HTTP/1.1" 404 43141 "https://fundaciopacopuerto.cat" rt="0.366" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36" "-" h="fundaciopacopuerto.cat" sn="fundaciopacopuerto.cat" ru="/mailto:[email protected] " u="/index.php" ucs="-" ua="unix:/var/run/php/fundacio82.sock" us="404" uct="0.000" urt="0.366"
206.232.3.54 - - [24/May/2026:12:09:39 +0000] "GET /mailto:[email protected] HTTP/1.1" 404 43144 "https://fundaciopacopuerto.cat" rt="0.394" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36" "-" h="fundaciopacopuerto.cat" sn="fundaciopacopuerto.cat" ru="/mailto:[email protected] " u="/index.php" ucs="-" ua="unix:/var/run/php/fundacio82.sock" us="404" uct="0.000" urt="0.394"
206.232.3.54 - - [24/May/2026:12:09:41 +0000] "GET /mailto:[email protected] HTTP/1.1" 404 43137 "https://fundaciopacopuerto.cat" rt="0.443
...
show less
Bad Web Bot
🇱🇻
garmtech.com
2026-05-18 07:52:55
(4 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:10-52.206.232.3.54
Web App Attack
🇺🇸
TPI-Abuse
2026-03-06 04:34:03
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 23:33:55.551402 2026] [security2:error] [pid 11819:tid 11819] [client 206.232.3.54:49567] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||constructionloansfunding.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "constructionloansfunding.com"] [uri "/mailto:[email protected] "] [unique_id "aapZMzLPCRrnyT4axbGC8gAAABc"], referer: http://constructionloansfunding.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-24 03:15:08
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 22:15:02.399410 2026] [security2:error] [pid 28684:tid 28684] [client 206.232.3.54:30681] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aZ0Xtr441CqCITQ3z3_jUAAAAAY"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
