🇺🇸
Shpanker
2026-05-12 15:22:45
(1 month ago)
Direct send phishing attack targeting Microsoft 365 tenant. Spoofing internal employee email address ...
show more
Direct send phishing attack targeting Microsoft 365 tenant. Spoofing internal employee email addresses via unauthorized direct send. Lures include voicemail, mailbox expiry, document review, HR documents, and e-sign templates.
show less
Port Scan
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2024-07-16 02:23:50
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 22:23:43.319971 2024] [security2:error] [pid 7049] [client 23.95.101.184:59226] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||peazy.net|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "peazy.net"] [uri "/"] [unique_id "ZpXZrzBMpNRXM5xEn74HAgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-16 02:08:43
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 22:08:40.763857 2024] [security2:error] [pid 25327] [client 23.95.101.184:61048] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||73.org|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "73.org"] [uri "/"] [unique_id "ZpXWKDJ8eE7ADg0nyU5NagAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2024-07-15 16:50:03
(1 year ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-15 11:30:20
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 07:30:12.580300 2024] [security2:error] [pid 28949:tid 47770422646528] [client 23.95.101.184:55601] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||dubarch.com|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "dubarch.com"] [uri "/"] [unique_id "ZpUIRMkCrfnpl5iSvW7DIQAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-15 11:01:10
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 07:01:06.543891 2024] [security2:error] [pid 27533] [client 23.95.101.184:63963] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||benefit-design.com|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "benefit-design.com"] [uri "/"] [unique_id "ZpUBckUFyhNf6_rX7RfNkAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-15 10:05:50
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 06:05:44.644816 2024] [security2:error] [pid 26208] [client 23.95.101.184:64254] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||1005kixfm.com|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "1005kixfm.com"] [uri "/"] [unique_id "ZpT0eLErt-hxCYxjHCsHIgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-07-15 09:18:20
(1 year ago)
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing. ...
show more
(mod_security) mod_security (id:210831) triggered by 23.95.101.184 (23-95-101-184-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 15 05:18:13.541887 2024] [security2:error] [pid 23173] [client 23.95.101.184:64587] [client 23.95.101.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||andrew.weigel.name|F|4"] [data "DTS Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "andrew.weigel.name"] [uri "/"] [unique_id "ZpTpVfTALDXts91gBR4QlQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack