|
🇸🇪
Johan Finn
|
|
malicious activity, botnet
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 91.107.149.78 (static.78.149.107.91.clients.you ...
show more
(mod_security) mod_security (id:217210) triggered by 91.107.149.78 (static.78.149.107.91.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 05 04:35:16.689450 2025] [security2:error] [pid 29739:tid 29739] [client 91.107.149.78:36200] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.architx.com:443|F|4"] [data "CONNECT www.architx.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.architx.com"] [uri "/"] [unique_id "aJHCRLaRActb2qPuU2To2AAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:217210) triggered by 91.107.149.78 (static.78.149.107.91.clients.you ...
show more
(mod_security) mod_security (id:217210) triggered by 91.107.149.78 (static.78.149.107.91.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 14:10:23.421250 2025] [security2:error] [pid 482:tid 482] [client 91.107.149.78:45766] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||koidivision.com:443|F|4"] [data "CONNECT koidivision.com:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "koidivision.com"] [uri "/"] [unique_id "aI0DD0fwfSRtoDmwx7ALIwAAAAY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
noah
|
|
"Botnet, Web scraping and Account brute forcing"
|
DDoS Attack
Open Proxy
Brute-Force
|
|
|
🇨🇭
SOC [GOLINE SA]
|
|
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Thu Jul 31 ...
show more
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Thu Jul 31 00:47:27.329407 2025] [security2:error] [pid 156918:tid 157011] [client 91.107.149.78:40400] [client 91.107.149.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "wp-login\\\\.php" at REQUEST_URI. [file "/etc/modsecurity/modsecurity.conf"] [line "229"] [id "92010"] [hostname "www.goline.ch"] [uri "/wp-login.php"] [unique_id "aIqg_9IGKwSrrBMqOZr-1gAAAE4"], referer: https://www.goline.ch/services/cpanel-hosting-goline-sa/
show less
|
Web App Attack
|
|
|
🇩🇪
bescared
|
|
F2B - Malicious activity detected. URL Probing.
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇳🇱
exxos
|
|
http-no-verb
|
Hacking
|
|
|
🇳🇱
exxos
|
|
HTTP1.x attacks
|
DDoS Attack
|
|
|
🇳🇱
exxos
|
|
http-no-verb
|
Hacking
|
|
|
🇳🇱
exxos
|
|
http-no-verb
|
Hacking
|
|
|
🇮🇹
VHosting
|
|
Detected WordPress attack from 4 different servers
|
Brute-Force
Web App Attack
|
|
|
🇨🇭
SOC [GOLINE SA]
|
|
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Fri Jul 25 ...
show more
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Fri Jul 25 12:54:03.203078 2025] [security2:error] [pid 1580953:tid 1580998] [client 91.107.149.78:37934] [client 91.107.149.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "wp-login\\\\.php" at REQUEST_URI. [file "/etc/modsecurity/modsecurity.conf"] [line "229"] [id "92010"] [hostname "www.goline.ch"] [uri "/wp-login.php"] [unique_id "aINiS0QLycYR_Ym9xj250wAAAAE"], referer: https://www.goline.ch/wp-login.php?action=register
show less
|
Web App Attack
|
|
|
🇨🇭
SOC [GOLINE SA]
|
|
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Fri Jul 25 ...
show more
Security Alert: 1 ModSecurity rule violation(s) from 91.107.149.78; Ports: *; Evidence: [Fri Jul 25 04:23:47.176997 2025] [security2:error] [pid 1580954:tid 1581030] [client 91.107.149.78:39220] [client 91.107.149.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "wp-login\\\\.php" at REQUEST_URI. [file "/etc/modsecurity/modsecurity.conf"] [line "229"] [id "92010"] [hostname "www.goline.ch"] [uri "/wp-login.php"] [unique_id "aILqs5SF8ysc4EpiOML9mgAAAEM"], referer: http://www.goline.ch/opportunities/
show less
|
Web App Attack
|
|
|
🇩🇪
tvipper.com
|
|
Auto reported by IDS
|
Hacking
|
|
|
🇫🇷
Murazaki
|
|
91.107.149.78 - - [20/Jul/2025:19:29:25 +0200] "CONNECT lemmy.balamb.fr:443 HTTP/1.1" 500 170 "-" "- ...
show more
91.107.149.78 - - [20/Jul/2025:19:29:25 +0200] "CONNECT lemmy.balamb.fr:443 HTTP/1.1" 500 170 "-" "-" "-"
...
show less
|
Hacking
|
|