🇸🇬
leithzz
2026-10-13 08:35:09
(1 week ago)
1x HTTP 403 to krynox.dev from US, method GET, path /.git/HEAD. Blocked by Cloudflare action block ( ...
show more
1x HTTP 403 to krynox.dev from US, method GET, path /.git/HEAD. Blocked by Cloudflare action block (firewallCustom). Repeated L7 flood traffic.
show less
DDoS Attack
Web App Attack
🇩🇪
mkln.org
2026-09-20 11:10:26
(1 month ago)
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all c ...
show more
Comment spam: 1 submissions to a WordPress comment form between 2026-09-20 and 2026-09-20 UTC, all caught by a hidden honeypot field.
show less
Blog Spam
🇮🇩
hermawan
2026-09-20 03:17:51
(1 month ago)
[Sun Sep 20 10:17:33.755850 2026] [security2:error] [pid 279877:tid 140496500422336] [client 206.232 ...
show more
[Sun Sep 20 10:17:33.755850 2026] [security2:error] [pid 279877:tid 140496500422336] [client 206.232.3.58:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "62341464827" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "107"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: 62341464827 found within REQUEST_FILENAME: /tel:+62341464827 request_line = HEAD /tel:+62341464827 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/tel:+62341464827"] [unique_id "aq9QTWF3qjjh_WUPuOHnCAAAAsg"], referer https://staklim-jatim.bmkg.go.id [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[279950] [I28WkyH9VQs] [aq9QTWF3qjjh_WUPuOHnCAAAAsg] keep_alive=[0] [2026-09-20 10:17:33.755854] [R:aq9QTWF3qjjh_WUPuOHnCAAAAsg] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36' Host:'staklim-j
...
show less
Email Spam
Hacking
🇳🇱
homeshowdomain.nl
2026-09-18 21:59:46
(1 month ago)
Auto-ban: >3000 req/min op 2026-09-18
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-15 22:36:44
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 18:36:39.027296 2026] [security2:error] [pid 9595:tid 9595] [client 206.232.3.58:32017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bankcardtexas.com"] [uri "/.git/HEAD"] [unique_id "aqnIdwsD61VDnXf7hPhtOAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-10 17:43:42
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 13:43:39.160733 2026] [security2:error] [pid 18002:tid 18002] [client 206.232.3.58:29863] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aqLsS0qa697O91CWnTIKSwAAABs"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-26 12:29:10
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 08:29:04.804321 2026] [security2:error] [pid 29686:tid 29686] [client 206.232.3.58:39067] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.pharmaceuticalsalescertifications.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.pharmaceuticalsalescertifications.com"] [uri "/mailto:[email protected] "] [unique_id "ao7cEIYLgtQalYHwIBXtLAAAAAY"], referer: https://www.pharmaceuticalsalescertifications.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 11:07:39
(2 months ago)
FortiWeb WAF: 22 attacks detected. Threat Score: 10822780. Types: Client Management(11), Signature D ...
show more
FortiWeb WAF: 22 attacks detected. Threat Score: 10822780. Types: Client Management(11), Signature Detection(11). Origin: United States.
show less
Web App Attack
🇳🇱
Savvii
2026-07-22 04:14:32
(2 months ago)
22 attempts against mh-misbehave-ban on pavo
Brute-Force
Bad Web Bot
Web App Attack
2026-07-22 02:03:54
(2 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 23:30:32
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 19:30:26.823643 2026] [security2:error] [pid 31806:tid 31806] [client 206.232.3.58:48139] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "aitFEgVapyH_72DTypwLbgAAAAo"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:24:14
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:24:05.401142 2026] [security2:error] [pid 12654:tid 12654] [client 206.232.3.58:60319] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "abz2FT9UXvWUtWP_EMf0dwAAAAs"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-09 01:30:24
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 08 21:30:21.302604 2026] [security2:error] [pid 20155:tid 20155] [client 206.232.3.58:57107] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||TransCapitalSolutions.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "transcapitalsolutions.com"] [uri "/mailto:[email protected] "] [unique_id "aa4irXGobCCM9xWNctdazwAAAAM"], referer: http://TransCapitalSolutions.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-12 10:55:44
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 206.232.3.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 05:55:39.314871 2026] [security2:error] [pid 31106:tid 31106] [client 206.232.3.58:42449] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "aY2xq-KUqJ1cLy8TEkEHLgAAAAE"], referer: http://www.CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
exxos
2025-10-01 03:03:01
(1 year ago)
HTTP1.x attacks
DDoS Attack
