🇬🇧
consul.to
2026-09-07 04:25:21
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
ne1for23
2026-07-26 02:10:37
(2 months ago)
Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" ...
show more
Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution.
64.227.79.137 - - [26/Jul/2026:02:10:37 +0000] "GET / HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 +https://forestengine.net/#opt-out" "-"
show less
Hacking
2025-08-04 15:36:56
(1 year ago)
Botnet - login attempts with leaked random user/pass lists
Hacking
Brute-Force
Web App Attack
🇨🇭
SOC [GOLINE SA]
2024-12-07 18:56:26
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland ...
show more
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland/Amsterdam/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; IP: 64.227.79.137; Ports: *; Direction: 0; Trigger: LF_TRIGGER; Logs: [Sat Dec 07 19:56:21.893305 2024] [security2:error] [pid 285443:tid 285527] [client 64.227.79.137:49048] [client 64.227.79.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.goline.ch"] [uri "/"] [unique_id "Z1SaVW0iynCiBQE88BotsgAAAAQ"]
show less
Brute-Force
🇵🇱
sefinek.net
2024-12-06 00:15:40
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: MANAGED_CHALLENGE
ASN: 14061 (DIGIT ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: MANAGED_CHALLENGE
ASN: 14061 (DIGITALOCEAN-ASN)
Protocol: HTTP/1.1 (GET method)
Zone: genshin.sefinek.net
Endpoint: /
Timestamp: 2024-12-05T23:07:14Z
Ray ID: 8ed7b0f9edb30b44
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Report generated by Cloudflare-WAF-To-AbuseIPDB:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇭
SOC [GOLINE SA]
2024-12-05 01:44:36
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland ...
show more
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland/Amsterdam/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; IP: 64.227.79.137; Ports: *; Direction: 0; Trigger: LF_TRIGGER; Logs: [Thu Dec 05 02:44:31.493491 2024] [security2:error] [pid 121821:tid 121910] [client 64.227.79.137:59540] [client 64.227.79.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.goline.ch"] [uri "/"] [unique_id "Z1EFf5b2hSBK6P_Cz7fy9gAAAEo"]
show less
Brute-Force
🇨🇭
SOC [GOLINE SA]
2024-12-03 17:48:32
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland ...
show more
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland/Amsterdam/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; IP: 64.227.79.137; Ports: *; Direction: 0; Trigger: LF_TRIGGER; Logs: [Tue Dec 03 18:48:31.577365 2024] [security2:error] [pid 1774:tid 1876] [client 64.227.79.137:44608] [client 64.227.79.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.goline.ch"] [uri "/"] [unique_id "Z09Eb_5rAy30S3PXyGDfegAAAAw"]
show less
Brute-Force
🇵🇱
sefinek.net
2024-12-01 19:08:09
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN) ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN)
Protocol: HTTP/3 (GET method)
Zone: sefinek.net
Endpoint: /
Timestamp: 2024-12-01T18:41:44Z
Ray ID: 8eb5368ebbb70a49
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.0.0 Safari/537.36
Report generated by Cloudflare-WAF-To-AbuseIPDB:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇭
SOC [GOLINE SA]
2024-11-29 22:28:04
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland ...
show more
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland/Amsterdam/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; IP: 64.227.79.137; Ports: *; Direction: 0; Trigger: LF_TRIGGER; Logs: [Fri Nov 29 23:28:01.281053 2024] [security2:error] [pid 790459:tid 790538] [client 64.227.79.137:50338] [client 64.227.79.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.goline.ch"] [uri "/"] [unique_id "Z0o_8cfNDqffaHw_ykBgvgAAAEI"]
show less
Brute-Force
🇨🇭
SOC [GOLINE SA]
2024-11-26 18:58:21
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland ...
show more
(mod_security) mod_security (id:949110) triggered by 64.227.79.137 (NL/The Netherlands/North Holland/Amsterdam/-/[AS14061 DIGITALOCEAN-ASN]): 1 in the last 3600 secs; IP: 64.227.79.137; Ports: *; Direction: 0; Trigger: LF_TRIGGER; Logs: [Tue Nov 26 19:58:17.224856 2024] [security2:error] [pid 521415:tid 521513] [client 64.227.79.137:37480] [client 64.227.79.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.goline.ch"] [uri "/"] [unique_id "Z0YaSd3_BR_NF8F1uel19wAAAFM"]
show less
Brute-Force
🇳🇱
Linuxmalwarehuntingnl
2024-07-04 07:05:09
(2 years ago)
Unauthorized connection attempt
Brute-Force
🇿🇦
IrisFlower
2022-05-25 10:09:45
(4 years ago)
Unauthorized connection attempt detected from IP address 64.227.79.137 to port 8118 [J]
Port Scan
Hacking
🇿🇦
IrisFlower
2022-05-25 08:43:37
(4 years ago)
Unauthorized connection attempt detected from IP address 64.227.79.137 to port 1080 [J]
Port Scan
Hacking
🇿🇦
IrisFlower
2022-05-25 06:31:07
(4 years ago)
Unauthorized connection attempt detected from IP address 64.227.79.137 to port 1080 [J]
Port Scan
Hacking
🇿🇦
IrisFlower
2022-05-25 04:40:06
(4 years ago)
Unauthorized connection attempt detected from IP address 64.227.79.137 to port 4153 [J]
Port Scan
Hacking