🇹🇷
Jova
2026-11-12 13:54:06
UTC ·
(1 day ago)
Web server path scanning: 15 nonexistent paths requested within a minute.
Web App Attack
🇦🇺
nzhost.co.nz
2026-11-12 09:07:42
UTC ·
(1 day ago)
$f2bV_matches
Hacking
Brute-Force
🇩🇪
pscriptos
2026-11-12 07:52:01
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
Web App Attack
Hacking
🇵🇹
Subnet Shadow Specter
2026-11-10 15:22:40
UTC ·
(3 days ago)
[CRITICAL][Security Alert] Targeted exploit scanning against Textbook Vulnerabilities. Bot hunting for PHP backdoors. [Method]: => GET. [Request]: => /static/warn/close.php. Access revoked. [User-Agent]: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl ...
show more
[CRITICAL][Security Alert] Targeted exploit scanning against Textbook Vulnerabilities. Bot hunting for PHP backdoors. [Method]: => GET. [Request]: => /static/warn/close.php. Access revoked. [User-Agent]: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36. [OS]: Windows. [IP Address]: 59.110.4.35. [IoA Datetime]: 2026-11-10 13:14:54 UTC.
show less
Bad Web Bot
Hacking
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 14:26:19
UTC ·
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:26:11.914387 2026] [security2:error] [pid 16594:tid 16594] [client 59.110.4.35:49462] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 09:26:11.914387 2026] [security2:error] [pid 16594:tid 16594] [client 59.110.4.35:49462] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.somuchtoread.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.somuchtoread.com"] [uri "/okok.cer"] [unique_id "avMpgyhdxuH4LRI48OZzGAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-09 01:37:09
UTC ·
(4 days ago)
Web attack/malicious scanning detected
Web App Attack
2026-11-08 06:30:40
UTC ·
(5 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-06 01:52:13
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:52:06.312674 2026] [security2:error] [pid 31592:tid 31592] [client 59.110.4.35:46474] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:52:06.312674 2026] [security2:error] [pid 31592:tid 31592] [client 59.110.4.35:46474] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||marjorierosenberg.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "marjorierosenberg.com"] [uri "/okok.cer"] [unique_id "au0yxmUXM8d1zKy9sx0yGwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 20:24:45
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:24:40.649084 2026] [security2:error] [pid 12741:tid 12741] [client 59.110.4.35:32842] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:24:40.649084 2026] [security2:error] [pid 12741:tid 12741] [client 59.110.4.35:32842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.serpentstudios.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.serpentstudios.com"] [uri "/okok.cer"] [unique_id "auzmCHnkVdSrPYL6k4ZimgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 17:52:05
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 12:52:00.791303 2026] [security2:error] [pid 13118:tid 13118] [client 59.110.4.35:33980] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 12:52:00.791303 2026] [security2:error] [pid 13118:tid 13118] [client 59.110.4.35:33980] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.compupackinc.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.compupackinc.com"] [uri "/okok.cer"] [unique_id "auzCQAqacUrylgU-RVKQBAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 02:13:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:13:17.508549 2026] [security2:error] [pid 20073:tid 20073] [client 59.110.4.35:37310] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:13:17.508549 2026] [security2:error] [pid 20073:tid 20073] [client 59.110.4.35:37310] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||luciferdirective.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "luciferdirective.com"] [uri "/okok.cer"] [unique_id "auvmPe6ZUlkncjcOruPEnwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 09:07:27
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 04:07:23.329513 2026] [security2:error] [pid 8752:tid 8752] [client 59.110.4.35:42866] ModSecu ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 04:07:23.329513 2026] [security2:error] [pid 8752:tid 8752] [client 59.110.4.35:42866] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||leolion.net|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "leolion.net"] [uri "/okok.cer"] [unique_id "aur1ywXAig9k7bVlRhBlfAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-11-03 17:50:26
UTC ·
(1 week ago)
59.110.4.35 - - [03/Nov/2026:12:49:48 -0500] "GET /shell.php HTTP/1.1" 404 42162 "https://keoweeliving.com/shell.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [0 ...
show more
59.110.4.35 - - [03/Nov/2026:12:49:48 -0500] "GET /shell.php HTTP/1.1" 404 42162 "https://keoweeliving.com/shell.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [03/Nov/2026:12:49:49 -0500] "GET /debug.php HTTP/1.1" 404 42162 "https://keoweeliving.com/debug.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [03/Nov/2026:12:50:25 -0500] "GET /info.php HTTP/1.1" 404 42162 "https://keoweeliving.com/info.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
IndigoRidge
2026-11-03 12:31:00
UTC ·
(1 week ago)
59.110.4.35 - - [03/Nov/2026:07:29:04 -0500] "GET /shell.php HTTP/1.1" 404 42162 "https://keoweeliving.com/shell.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [0 ...
show more
59.110.4.35 - - [03/Nov/2026:07:29:04 -0500] "GET /shell.php HTTP/1.1" 404 42162 "https://keoweeliving.com/shell.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [03/Nov/2026:07:29:05 -0500] "GET /debug.php HTTP/1.1" 404 42162 "https://keoweeliving.com/debug.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
59.110.4.35 - - [03/Nov/2026:07:31:00 -0500] "GET /info.php HTTP/1.1" 404 42162 "https://keoweeliving.com/info.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 23:00:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 18:00:29.209410 2026] [security2:error] [pid 11642:tid 11642] [client 59.110.4.35:34964] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 59.110.4.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 18:00:29.209410 2026] [security2:error] [pid 11642:tid 11642] [client 59.110.4.35:34964] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||jessemack.com|F|2"] [data ".cer"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jessemack.com"] [uri "/okok.cer"] [unique_id "aukWDUPLr3Sgl-GnvXv06QAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
