🇺🇸
TPI-Abuse
2026-11-15 09:39:48
UTC ·
(45 minutes ago)
(mod_security) mod_security (id:210730) triggered by 86.127.231.19 (86-127-231-19.digimobil.es): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:39:44.276435 2026] [security2:error] [pid 12544:tid 12544] [clie ...
show more
(mod_security) mod_security (id:210730) triggered by 86.127.231.19 (86-127-231-19.digimobil.es): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 04:39:44.276435 2026] [security2:error] [pid 12544:tid 12544] [client 86.127.231.19:33888] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.gsrsv.org|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.gsrsv.org"] [uri "/springtimeinc.com"] [unique_id "avl94CgoQsqMys2A_PURVgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
IPCollective Intelligence
2026-11-10 00:50:27
UTC ·
(5 days ago)
Residential Proxy - IPCollective Intelligence
Open Proxy
🇺🇸
justbible
2026-11-06 06:18:12
UTC ·
(1 week ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 33 requests from 2026-11-06T06:18:12+00:00 to 2026-11-11T10:45:00+00:00, e.g. 'GET /en/kjv,darby/obad/1/1 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64; rv:155.0) ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 33 requests from 2026-11-06T06:18:12+00:00 to 2026-11-11T10:45:00+00:00, e.g. 'GET /en/kjv,darby/obad/1/1 HTTP/2.0' with User-Agent 'Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇺🇸
jakob
2026-11-04 10:23:02
UTC ·
(1 week ago)
Fail2Ban rule: apache-cgit (robots.txt violation)
Bad Web Bot
2026-10-31 17:58:09
UTC ·
(2 weeks ago)
🤡 Fake Googlebot crawler detected. The IP used the Googlebot user-agent but does not belong to Google's verified crawler IP ranges.
Bad Web Bot
🇩🇪
LRob
2026-10-09 09:28:48
UTC ·
(1 month ago)
Shop search flood (L7 DDoS) | path: /79-vtt-all-mountain | query: q=Mat%C3%A9riau-Aluminium/Famille-Oiz/Taille-L | src_port: 50442
DDoS Attack
Web App Attack
2026-10-05 18:15:17
UTC ·
(1 month ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /wishlist/index/add/product/10940/form_key/li4ks1vOiZfBWsrc/ | UA: Opera/8.38.(Windows CE; byn-ER) Presto/2.9.187 Version/10.00 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-01 16:49:57
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-30 13:14:36
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-30 12:09:48
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 14:03:54
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-22 10:02:57
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 08:15:20
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇪🇸
robotstxt
2025-05-06 08:36:46
UTC ·
(1 year ago)
86.127.231.19 - - [06/May/2025:08:36:06 +0000] "GET /cgi-bin/welcome HTTP/2.0" 404 29012 "https://localhost/cgi-bin/welcome" rt="0.816" "SonicWALL NetExtender for Windows" "86.127.231.19" h="www.ccoo.cat" sn="www.ccoo.cat" ru="/cgi-bin/welcome" u="/i ...
show more
86.127.231.19 - - [06/May/2025:08:36:06 +0000] "GET /cgi-bin/welcome HTTP/2.0" 404 29012 "https://localhost/cgi-bin/welcome" rt="0.816" "SonicWALL NetExtender for Windows" "86.127.231.19" h="www.ccoo.cat" sn="www.ccoo.cat" ru="/cgi-bin/welcome" u="/index.php" ucs="-" ua="unix:/var/run/php/ccoocat82.sock" us="404" uct="0.000" urt="0.816"
86.127.231.19 - - [06/May/2025:08:36:06 +0000] "GET /cgi-bin/welcome HTTP/2.0" 404 29012 "https://localhost/cgi-bin/welcome" "SonicWALL NetExtender for Windows" "86.127.231.19"
86.127.231.19 - - [06/May/2025:08:36:04 +0000] "GET /cgi-bin/welcome HTTP/2.0" 404 29006 "https://localhost/cgi-bin/welcome" rt="0.947" "SonicWALL NetExtender for Windows" "86.127.231.19" h="www.ccoo.cat" sn="www.ccoo.cat" ru="/cgi-bin/welcome" u="/index.php" ucs="-" ua="unix:/var/run/php/ccoocat82.sock" us="404" uct="0.000" urt="0.948"
86.127.231.19 - - [06/May/2025:08:36:08 +0000] "GET /cgi-bin/userLogin HTTP/2.0" 404 29013 "https://localhost/cgi-bin/welcome" rt="0.942" "SonicW
...
show less
Bad Web Bot
