|
🇮🇳
evicky2002
|
|
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
|
Hacking
Brute-Force
SSH
|
|
|
🇺🇸
tropicalidad.be
|
|
blog spam/exploit attempt
|
Blog Spam
Hacking
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 11:55:20.214854 2026] [security2:error] [pid 3987290:tid 3987310] [client 64.112.56.148:42345] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected||uoexpanse.com|F|2"] [data "Matched Data: onerror= found within REQUEST_URI: /forums/viewtopic.php?f=38\\x22><img src=x onerror=alert(qsxss9k7z)>&t=1018"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "uoexpanse.com"] [uri "/forums/viewtopic.php"] [unique_id "anC56P0K2YyTfUhw4ZiTTwAAABI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 11:27:11.539162 2026] [security2:error] [pid 3833411:tid 3833411] [client 64.112.56.148:44327] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected||watermarks.info|F|2"] [data "Matched Data: onload= found within REQUEST_URI: /bus.php?tx&a=s&t=a&s=7&db=i&i=on&o=n'\\x22><svg/onload=confirm(qsxss9k7z)>&c&pw=on&v=0&n=20&sk=0&l=i"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "watermarks.info"] [uri "/bus.php"] [unique_id "anCzT2KDnvFkWwSe46u7egAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212750) triggered by 64.112.56.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 10:54:20.942626 2026] [security2:error] [pid 301302:tid 301302] [client 64.112.56.148:44463] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected||www.powerkiteforum.com|F|2"] [data "Matched Data: onload= found within REQUEST_URI: /viewthread.php?tid=22543\\x22><svg onload=alert(qsxss9k7z)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "anCrnPLKeBcezHscUiY89wAAABg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
ipblock.com
|
|
IPBlock protected site ID [4055-d][s=06].
Exploit request, vulnerability scanner.
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇧🇪
cmbplf
|
|
2.110 requests from abuseipdb.com blacklisted IP (10mos1w4d)
|
Brute-Force
Bad Web Bot
|
|
|
🇺🇸
ipblock.com
|
|
IPBlock protected site ID [4055-d][s=06].
Exploit request, vulnerability scanner.
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇩🇪
conseilgouz
|
|
ece-12 : Block return, carriage return, ... characters=>/media/astroid/js/script.min.js?7ea5d6=' ...
show more
ece-12 : Block return, carriage return, ... characters=>/media/astroid/js/script.min.js?7ea5d6='(')
show less
|
Hacking
|
|
|
🇩🇪
iGroupware
|
|
{"req/ip"=>{:discriminator=>"64.112.56.148", :count=>1, :period=>180, :limit=>500, :epoch_time=>1785 ...
show more
{"req/ip"=>{:discriminator=>"64.112.56.148", :count=>1, :period=>180, :limit=>500, :epoch_time=>1785023409}, "signups/ip"=>{:discriminator=>"64.112.56.148", :count=>1, :period=>3600, :limit=>5, :epoch_time=>1785023409}, "signups/email"=>{:discriminator=>"[email protected]", :count=>12, :period=>86400, :limit=>2, :epoch_time=>1785023409}}
show less
|
Web App Attack
|
|
|
🇺🇸
MaxSmartCode
|
|
Credential brute-force attacks on webpage.
|
Brute-Force
SSH
|
|
|
🇺🇸
ipblock.com
|
|
IPBlock protected site ID [4055-d][s=06].
Exploit request, vulnerability scanner.
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TheJimmo
|
|
64.112.56.148 64.112.56.148 - - [16/Jul/2026:13:45:39 +0000] "GET /assets/file:%2f%2f%7B%7Bpath%7D%7 ...
show more
64.112.56.148 64.112.56.148 - - [16/Jul/2026:13:45:39 +0000] "GET /assets/file:%2f%2f%7B%7Bpath%7D%7D/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
64.112.56.148 64.112.56.148 - - [16/Jul/2026:13:45:52 +0000] "GET /cgi-bin/export-cgi?category=config&arg0=startup-config.conf HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
64.112.56.148 64.112.56.148 - - [16/Jul/2026:13:45:40 +0000] "GET /tiki-login_scr.php HTTP/1.1" 404 13364 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
64.112.56.148 64.112.56.148 - - [16/Jul/2026:13:45:42 +0000] "POST /session/create HTTP/1.1" 404 13358 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTM
...
show less
|
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Bot / scanning and/or hacking attempts: GET /xmlrpc.php?rsd=' HTTP/2.0, [0/0] init
|
Hacking
Web App Attack
|
|
|
🇩🇪
conseilgouz
|
|
vee-12 : Block return, carriage return, ... characters=>/component/weblinks/weblink/37-hl-detailing? ...
show more
vee-12 : Block return, carriage return, ... characters=>/component/weblinks/weblink/37-hl-detailing?catid=12&amp;Itemid=1029'&task=weblink.go(')
show less
|
Hacking
|
|