🇺🇸
TPI-Abuse
2026-11-14 01:11:58
UTC ·
(19 hours ago)
(mod_security) mod_security (id:221260) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:11:50.945469 2026] [security2:error] [pid 2 ...
show more
(mod_security) mod_security (id:221260) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:11:50.945469 2026] [security2:error] [pid 21570:tid 21570] [client 32.184.6.197:47469] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||karenbernsteinlaw.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karenbernsteinlaw.com"] [uri "/"] [unique_id "ave1Vh4iwwyhAB0QLFSOpQAAAB0"], referer: () { _; } >_[$($())] { echo 93e4r0-cve-2014-6278: true; echo;echo; }
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-13 18:45:23
UTC ·
(1 day ago)
15 requests with url.path *.dll
Brute-Force
Bad Web Bot
🇶🇦
Cyber_SOC
2026-11-13 13:51:00
UTC ·
(1 day ago)
Php Injection
Web App Attack
2026-11-12 15:50:29
UTC ·
(2 days ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 09:05:09
UTC ·
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:05:04.021316 2026] [security2:error] [pid 2 ...
show more
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 04:05:04.021316 2026] [security2:error] [pid 20633:tid 20633] [client 32.184.6.197:51616] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||agapeaccountingllc.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "agapeaccountingllc.com"] [uri "/trace.axd"] [unique_id "avQvwBfU5vWHUbPWL9YPPQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-10 23:04:10
UTC ·
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
mnsf
2026-11-10 22:05:09
UTC ·
(3 days ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
francelink.fr
2026-11-10 20:07:25
UTC ·
(4 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-10T20:05:04.000Z.
Web App Attack
🇺🇸
Blamdom
2026-11-10 08:07:52
UTC ·
(4 days ago)
Secret/config-file recon: requested /actuator/env. 562 HTTP request(s), 2026-11-10 08:07:52 to 08:14:26 UTC (6m34s).
Requests (method path -> status xcount):
GET [site page] -> 404 x469
GET /wp-content/... -> 200 x33
GET /wp-includes/... -> 200 ...
show more
Secret/config-file recon: requested /actuator/env. 562 HTTP request(s), 2026-11-10 08:07:52 to 08:14:26 UTC (6m34s).
Requests (method path -> status xcount):
GET [site page] -> 404 x469
GET /wp-content/... -> 200 x33
GET /wp-includes/... -> 200 x12
GET / -> 200 x8
GET [site page] -> 301 x6
GET /?[query] -> 200 x3
GET /_mem_bin/... -> 404 x3
OPTIONS / -> 200 x2
...+26 more distinct requests
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36 (+5 other UAs)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:28:34
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:28:29.376971 2026] [security2:error] [pid 8 ...
show more
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:28:29.376971 2026] [security2:error] [pid 8783:tid 8783] [client 32.184.6.197:39612] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.15|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.15"] [uri "/com.cer"] [unique_id "avKBTZyaO3QDLK7O4ACmRAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WPJoe
2026-11-08 21:02:05
UTC ·
(6 days ago)
32.184.6.197 - - [08/Nov/2026:21:01:40 +0000] "GET /privacy.html HTTP/1.1" 404 174751 "-" "Mozilla/5.0 (compatible; CowbellPrivacyScanner/1.0; +https://cowbell.insure/)"
32.184.6.197 - - [08/Nov/2026:21:01:40 +0000] "GET /privacy-notice HTTP/1.1" 404 ...
show more
32.184.6.197 - - [08/Nov/2026:21:01:40 +0000] "GET /privacy.html HTTP/1.1" 404 174751 "-" "Mozilla/5.0 (compatible; CowbellPrivacyScanner/1.0; +https://cowbell.insure/)"
32.184.6.197 - - [08/Nov/2026:21:01:40 +0000] "GET /privacy-notice HTTP/1.1" 404 174751 "-" "Mozilla/5.0 (compatible; CowbellPrivacyScanner/1.0; +https://cowbell.insure/)"
32.184.6.197 - - [08/Nov/2026:21:01:45 +0000] "GET /wp-content/uploads/ HTTP/1.1" 403 366 "-" "SonyEricssonW995/R1EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.0"
32.184.6.197 - - [08/Nov/2026:21:01:46 +0000] "GET /server-status HTTP/1.1" 403 4376 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36"
32.184.6.197 - - [08/Nov/2026:21:01:40 +0000] "POST /mcp HTTP/1.1" 404 35320 "-" "python-httpx/0.28.1"
32.184.6.197 - - [08/Nov/2026:21:01:46 +0000] "GET /icons/ HTTP/1.1" 403 422 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.
...
show less
Web App Attack
Bad Web Bot
2026-11-08 14:05:06
UTC ·
(6 days ago)
Blocked: Reason='Possible SQL injection activity (4/60 min)'; Requests=4
SQL Injection
🇺🇸
joeyyax
2026-11-08 13:55:37
UTC ·
(6 days ago)
Tried router exploits ×1. Paths: /HNAP1
Hacking
IoT Targeted
🇺🇸
TPI-Abuse
2026-11-08 13:35:45
UTC ·
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:35:40.610570 2026] [security2:error] [pid 2 ...
show more
(mod_security) mod_security (id:210730) triggered by 32.184.6.197 (ec2-32-184-6-197.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:35:40.610570 2026] [security2:error] [pid 24813:tid 24813] [client 32.184.6.197:33396] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mrsreclamation.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mrsreclamation.com"] [uri "/trace.axd"] [unique_id "avB6rFa3tAYDDLQq7de9SAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-11-08 13:31:26
UTC ·
(6 days ago)
32.184.6.197 - - [08/Nov/2026:08:29:19 -0500] "GET /site.zip HTTP/1.1" 404 68854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36"
32.184.6.197 - - [08/Nov/2026:08:31:11 -0500] " ...
show more
32.184.6.197 - - [08/Nov/2026:08:29:19 -0500] "GET /site.zip HTTP/1.1" 404 68854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36"
32.184.6.197 - - [08/Nov/2026:08:31:11 -0500] "GET /backup.tar.gz HTTP/1.1" 404 68854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36"
32.184.6.197 - - [08/Nov/2026:08:31:25 -0500] "GET /database.sql HTTP/1.1" 404 68854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1234.56 Safari/537.36"
...
show less
Web App Attack
