🇺🇸
StateWork
2026-05-26 17:30:00
(3 weeks ago)
Looking for exploits
Brute-Force
Web App Attack
Hacking
🇵🇰
sbk97 (https://sayor.net)
2026-05-25 16:58:19
(3 weeks ago)
HTTP attacks observed: GET / HTTP/1.1 | status=200 || GET /Telerik.Web.UI.DialogHandler.aspx HTTP/1. ...
show more
HTTP attacks observed: GET / HTTP/1.1 | status=200 || GET /Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModules/Admin/RadEditorProvider/DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModule/UIQuestionControls/UIAskQuestion/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /Modules/CMS/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModules/TelerikWebUI/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /Admin/ServerSide/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModules/TNComments/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModules/TelerikWebUI/RadEditorProvider/Telerik.Web.UI.DialogHandler.aspx HTTP/1.1 | status=404 || GET /DesktopModules/dnnWerk.RadEditorProvider/DialogHandler.aspx HTTP/1.1 | status=404 || GET /common/admin/Calendar/Telerik.Web.UI.DialogHandler.aspx HTTP/
show less
Brute-Force
🇵🇰
sbk97 (https://sayor.net)
2026-05-25 16:56:28
(3 weeks ago)
HTTP attack observed: GET / HTTP/1.1 | status=200 | response_size=59104
Port Scan
🇮🇩
David Koswari
2026-05-25 05:23:00
(3 weeks ago)
REQ_BLOCKED_ACL
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇺🇸
NXTwoThou
2026-05-22 11:00:00
(4 weeks ago)
/Telerik.Web.UI.DialogHandler.aspx
Web App Attack
🇫🇷
dwmp
2026-05-22 06:26:49
(4 weeks ago)
Url probing: /DesktopModules/Admin/RadEditorProvider/DialogHandler.aspx/
Web App Attack
🇪🇸
librebit
2026-05-15 06:20:38
(1 month ago)
Brute force
Brute-Force
🇬🇧
AvonleaConsulting
2026-05-13 13:05:08
(1 month ago)
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
Bad Web Bot
Web App Attack
2026-05-08 00:12:12
(1 month ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-02-16 04:33:48
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 23.254.227.126 (hwsrv-733735.hostwindsdns.com): ...
show more
(mod_security) mod_security (id:210730) triggered by 23.254.227.126 (hwsrv-733735.hostwindsdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 23:33:45.759977 2026] [security2:error] [pid 11629:tid 11629] [client 23.254.227.126:57702] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sfholidayrentals.com|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sfholidayrentals.com"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aZKeKcxKXp23uHldSx7DJgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-16 03:03:55
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 23.254.227.126 (hwsrv-733735.hostwindsdns.com): ...
show more
(mod_security) mod_security (id:210730) triggered by 23.254.227.126 (hwsrv-733735.hostwindsdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 22:03:48.417859 2026] [security2:error] [pid 5263:tid 5263] [client 23.254.227.126:60987] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||rharano.org|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rharano.org"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aZKJFMT9i0U4ZY4G0Hhp7AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
findlab
2026-02-11 17:00:02
(4 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇩🇪
findlab
2026-02-09 23:00:02
(4 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇪🇸
librebit
2026-02-06 05:58:15
(4 months ago)
Brute force
Brute-Force
🇨🇭
Origon
2026-02-04 12:45:11
(4 months ago)
CVE-2019-18935 - IP: 23.254.227.126 - time="2026-02-04T13:45:11+01:00" level=info msg="(555f66b4f6a ...
show more
CVE-2019-18935 - IP: 23.254.227.126 - time="2026-02-04T13:45:11+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/CVE-2019-18935 by ip 23.254.227.126 (US/54290) : 4h ban on Ip 23.254.227.126" module=db
show less
Web App Attack