🇩🇪
pltcldvlpr
2026-06-12 04:26:23
(1 week ago)
Bogus Useragent: 216.131.84.154 - - [12/Jun/2026:06:26:22 +0200] "GET /mandate?id=bb_8_spd_martina-m ...
show more
Bogus Useragent: 216.131.84.154 - - [12/Jun/2026:06:26:22 +0200] "GET /mandate?id=bb_8_spd_martina-maxi-schmidt HTTP/1.1" 200 186172 "-" "Mozilla/5.0 (compatible; MSIE 7.0; Windows 98; Win 9x 4.90; Trident/4.1)" asn=22781 org="Strong Technology, LLC." country=US
...
show less
Bad Web Bot
🇳🇱
EGP Abuse Dept
2026-06-10 06:26:18
(1 week ago)
Scraping webshop URLs (www.badgehouder.nl), likely botnet drone
Bad Web Bot
Exploited Host
🇩🇪
filstal.org
2026-04-27 12:34:03
(1 month ago)
Bad web bot: Spoofed/obsolete UA (Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/3.0)). Mass ...
show more
Bad web bot: Spoofed/obsolete UA (Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/3.0)). Mass-scanning WordPress plugin. Coordinated large-scale bot attack.
show less
Bad Web Bot
Web App Attack
🇮🇩
xveil
2026-03-26 16:09:51
(2 months ago)
2026-03-26T23:09:48.499070 mail-honeypot postfix/submission/smtpd[25523]: warning: 216-131-84-154.cv ...
show more
2026-03-26T23:09:48.499070 mail-honeypot postfix/submission/smtpd[25523]: warning: 216-131-84-154.cvg.as22781.net[216.131.84.154]: SASL LOGIN authentication failed: authentication failure
...
show less
Brute-Force
🇮🇩
xveil
2026-03-24 22:54:03
(2 months ago)
2026-03-25T05:54:01.548047 mail-honeypot postfix/submission/smtpd[1868]: warning: 216-131-84-154.cvg ...
show more
2026-03-25T05:54:01.548047 mail-honeypot postfix/submission/smtpd[1868]: warning: 216-131-84-154.cvg.as22781.net[216.131.84.154]: SASL LOGIN authentication failed: authentication failure
...
show less
Brute-Force
🇮🇩
xveil
2026-03-21 16:21:43
(2 months ago)
2026-03-21T23:21:41.326349 mail-honeypot postfix/submission/smtpd[27615]: warning: 216-131-84-154.cv ...
show more
2026-03-21T23:21:41.326349 mail-honeypot postfix/submission/smtpd[27615]: warning: 216-131-84-154.cvg.as22781.net[216.131.84.154]: SASL LOGIN authentication failed: authentication failure
...
show less
Brute-Force
🇩🇪
ps-center
2026-02-12 23:29:24
(4 months ago)
ABV: Web Attack GET /ch-links-verlag/wp-login.php
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-07 14:09:28
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:225170) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 07 09:09:20.412416 2026] [security2:error] [pid 18052:tid 18052] [client 216.131.84.154:11378] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||borzois.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "borzois.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aYdHkF-caRk_38yK2F3beAAAABo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-12-24 03:46:03
(5 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇩🇪
botreporter
2025-08-30 21:26:48
(9 months ago)
botnet ignoring robots.txt
Bad Web Bot
🇺🇸
TPI-Abuse
2025-04-28 08:32:33
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 04:32:25.546242 2025] [security2:error] [pid 18887:tid 18887] [client 216.131.84.154:51390] [client 216.131.84.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "catking.net"] [uri "/.env"] [unique_id "aA89GQu5vyL39XzVJt688gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-28 08:09:15
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 04:09:13.232761 2025] [security2:error] [pid 8526:tid 8526] [client 216.131.84.154:62125] [client 216.131.84.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intervinum.net"] [uri "/.env"] [unique_id "aA83qWZjFAyPUZTGzxYYfgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-28 06:48:41
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 02:48:37.953538 2025] [security2:error] [pid 9219:tid 9219] [client 216.131.84.154:58103] [client 216.131.84.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "winterspring.net"] [uri "/.env"] [unique_id "aA8kxZ2UFSgWCe_Krgvx7QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-28 06:05:26
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 02:05:21.232914 2025] [security2:error] [pid 2931253:tid 2931253] [client 216.131.84.154:62190] [client 216.131.84.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icro.net"] [uri "/.env"] [unique_id "aA8aofCZt5PfrcJa1t3zdAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-28 05:37:51
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net) ...
show more
(mod_security) mod_security (id:210492) triggered by 216.131.84.154 (216-131-84-154.cvg.as22781.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 01:37:46.366193 2025] [security2:error] [pid 1498350:tid 1498350] [client 216.131.84.154:59791] [client 216.131.84.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "addpromo.net"] [uri "/.env"] [unique_id "aA8UKtXd00x55N4klSuL8AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack