🇪🇸
bohl-aiG5aef
2026-10-18 07:14:18
(5 days ago)
Suricata Alert [SID:2009714] ET WEB_SERVER Script tag in URI Possible Cross Site Scripting Attempt
Web App Attack
🇪🇸
bohl-aiG5aef
2026-10-18 06:18:00
(5 days ago)
Suricata Alert [SID:2009715] ET WEB_SERVER Onmouseover= in URI - Likely Cross Site Scripting Attempt
Web App Attack
🇺🇸
drewf.ink
2026-09-29 04:40:24
(3 weeks ago)
[04:40] Attempted HTTPS GlobalProtect login with credentials jstrickland:W******1
Web App Attack
🇺🇸
maxasp.net
2026-09-18 01:25:37
(1 month ago)
Invalid var_id in cart/add; Attack Var: var_id3; Attack Data: 440202PournMvF') OR 567=(SELECT 567 FR ...
show more
Invalid var_id in cart/add; Attack Var: var_id3; Attack Data: 440202PournMvF') OR 567=(SELECT 567 FROM PG_SLEEP(15))--
show less
Hacking
2026-09-11 00:14:03
(1 month ago)
apache vulnerability scan
Web App Attack
🇫🇷
Sklurk
2026-08-14 08:04:44
(2 months ago)
Web App Attack
Web App Attack
🇫🇷
Sklurk
2026-08-10 05:56:34
(2 months ago)
Web App Attack
Web App Attack
🇪🇸
librebit
2026-06-24 10:13:35
(3 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-06-23 08:55:15
(4 months ago)
Brute force
Brute-Force
2026-06-22 19:07:16
(4 months ago)
RdpGuard detected brute-force attempt on RD-WEB
Brute-Force
🇺🇸
TPI-Abuse
2026-02-11 23:51:31
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 18:51:22.237642 2026] [security2:error] [pid 26965:tid 26965] [client 45.3.37.134:22673] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkml.com"] [uri "/config/.env"] [unique_id "aY0V-kuAN-eSC10NvXxxbQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-02-11 21:04:17
(8 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 15:11:39
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 10:11:34.452137 2026] [security2:error] [pid 25707:tid 25707] [client 45.3.37.134:48383] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anthraxbooks.info"] [uri "/admin/.git/config"] [unique_id "aYtKphzznIUPmN4t2h53AQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 04:58:09
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:58:02.600831 2026] [security2:error] [pid 2274:tid 2274] [client 45.3.37.134:10119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kmashburn.com"] [uri "/.env.production"] [unique_id "aYq62npKCx9L0qlW0MPKJAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 03:04:40
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.37.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 22:04:32.380080 2026] [security2:error] [pid 10593:tid 10593] [client 45.3.37.134:49807] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madrigalscripts.com"] [uri "/app/.git/config"] [unique_id "aYqgQII-6pRhAFpOU0DXgwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
