🇵🇰
sbk97 (https://sayor.net)
2026-05-28 01:09:39
(2 months ago)
HTTP attacks observed: x16x03x01x05xdex01 | status=400 || GET / HTTP/2.0 | status=200
Brute-Force
🇵🇰
sbk97 (https://sayor.net)
2026-05-28 01:09:38
(2 months ago)
HTTP attack observed: x16x03x01x05xdex01 | status=400 | response_size=226
Brute-Force
🇺🇸
TPI-Abuse
2026-05-27 17:02:00
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 8.230.126.102 (102.126.230.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 8.230.126.102 (102.126.230.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 13:01:55.807936 2026] [security2:error] [pid 32601:tid 32601] [client 8.230.126.102:55744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.baiaosantos.com"] [uri "/config/config.yml"] [unique_id "ahcjg4Xv_KYTAZLBMjDVrQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 15:17:20
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 8.230.126.102 (102.126.230.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 8.230.126.102 (102.126.230.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 11:17:16.855656 2026] [security2:error] [pid 9444:tid 9444] [client 8.230.126.102:52772] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.watermarks.info|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.watermarks.info"] [uri "/.config/gcloud/credentials.db"] [unique_id "ahcK_ABau06PQSLamBf7rQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-05-27 12:30:28
(3 months ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
ConsulHosting
2026-05-27 10:11:07
(3 months ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇫🇷
dynamix
2026-05-27 09:12:47
(3 months ago)
Multiple WAF Violations
Web App Attack
🇩🇪
gadix
2026-05-27 08:45:24
(3 months ago)
[27/May/2026:10:45:19.689922 +0200] ahavHwjM3QhOcQ7fmy2qlwAAAAQ 8.230.126.102 39780 127.0.0.1 7081
[ ...
show more
[27/May/2026:10:45:19.689922 +0200] ahavHwjM3QhOcQ7fmy2qlwAAAAQ 8.230.126.102 39780 127.0.0.1 7081
[27/May/2026:10:45:20.935015 +0200] ahavII7ccpsnzfEkl8luXwAAAAA 8.230.126.102 40458 127.0.0.1 7081
[27/May/2026:10:45:20.950888 +0200] ahavIF8XylyZTV02EEmf2QAAAAY 8.230.126.102 40462 127.0.0.1 7081
...
show less
Web App Attack
🇩🇪
XICTRON
2026-05-27 07:25:04
(3 months ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇺🇸
TPI-Abuse
2026-05-27 07:02:49
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 8.230.126.102 (102.126.230.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 8.230.126.102 (102.126.230.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 03:02:43.956786 2026] [security2:error] [pid 16180:tid 16180] [client 8.230.126.102:45694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.zoboz.com"] [uri "/config/parameters.yml"] [unique_id "ahaXE7IlW8T2_pH4zLMIqAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-05-27 05:14:13
(3 months ago)
130 attacks on config grabbing URLs (type 2), deployment descriptor URLs, config grabbing URLs, site ...
show more
130 attacks on config grabbing URLs (type 2), deployment descriptor URLs, config grabbing URLs, site downloads, PHP URLs, password grabbing URLs:
GET /app/config/config.yml HTTP/1.1
GET /WEB-INF/web.xml HTTP/1.1
GET /.htaccess HTTP/1.1
GET /web.zip HTTP/1.1
GET /system/application/config/database.php HTTP/1.1
GET /.vscode/sftp.json HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-05-27 03:06:21
(3 months ago)
Too many Status 40X (11)
Scanning/Probing (61)
Request Overload (383)
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-05-26 23:23:24
(3 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-05-26 22:30:06
(3 months ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-05-26 21:30:14
(3 months ago)
SPAM - Bruteforce Attack - DDOS 1
Email Spam
Brute-Force