🇺🇸
TPI-Abuse
2026-10-28 00:02:36
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:02:31.177605 2026] [security2:error] [pid 13818:tid 13818] [client 191.102.129.133:6505 ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:02:31.177605 2026] [security2:error] [pid 13818:tid 13818] [client 191.102.129.133:65059] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "auE7l2dpU4lFq7HrnoxPEwAAAA0"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:39:15
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:39:07.926211 2026] [security2:error] [pid 30992:tid 30992] [client 191.102.129.133:2932 ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:39:07.926211 2026] [security2:error] [pid 30992:tid 30992] [client 191.102.129.133:29329] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "atR3mxHER7lwNNbzpqlQnQAAAAY"], referer: http://holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 04:30:47
(2 weeks ago)
Network service scanning detected by FortiGate; source quarantined.
Port Scan
🇮🇩
hermawan
2026-10-06 01:27:44
(4 weeks ago)
[Tue Oct 06 08:27:43.650713 2026] [authz_core:error] [pid 1204547:tid 140666039932608] [client 191.102.129.133:0] AH01630: client denied by server configuration: /var/www/html/gambarku/sys-metrics.php, referer https://staklim-jatim.bmkg.go.id [stakli ...
show more
[Tue Oct 06 08:27:43.650713 2026] [authz_core:error] [pid 1204547:tid 140666039932608] [client 191.102.129.133:0] AH01630: client denied by server configuration: /var/www/html/gambarku/sys-metrics.php, referer https://staklim-jatim.bmkg.go.id [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1204576] [ecq+5+GvlGA] [asROjwInc6_rP82lI-kX4wAAAAA] keep_alive=[0] [2026-10-06 08:27:43.650720] [R:asROjwInc6_rP82lI-kX4wAAAAA] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' Referer:'https://staklim-jatim.bmkg.go.id Accept-Encoding:'gzip, br Accept-Language:'*
...
show less
Email Spam
Hacking
🇩🇪
Carsten
2026-10-05 11:59:11
(4 weeks ago)
GET [.git/HEAD]
Port Scan
🇵🇱
Budyn
2026-09-23 16:57:42
(1 month ago)
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_5 | Action: AWS API Call | Token: oivim5afqu4p15ffms5ex4pv4 | Client Tool: Boto3/1.42.60 md/Botocore#1.42.60 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl ...
show more
Budyn SOC Canary Trap: AWS Key Compromised! | Memo: AWS_Token_5 | Action: AWS API Call | Token: oivim5afqu4p15ffms5ex4pv4 | Client Tool: Boto3/1.42.60 md/Botocore#1.42.60 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython m/E,e,b,Z cfg/retry-mode#standard B...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-19 05:46:21
(1 month ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: HEAD | path: /tel:0232222250 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 | 2026-09-19 ...
show more
Malicious web request: probing for secrets, traversal or a known exploit path | method: HEAD | path: /tel:0232222250 | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 | 2026-09-19 05:46 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:55:03
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:54:55.559204 2026] [security2:error] [pid 8862:tid 8862] [client 191.102.129.133:44927] ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:54:55.559204 2026] [security2:error] [pid 8862:tid 8862] [client 191.102.129.133:44927] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||transcapitalsolutions.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "transcapitalsolutions.com"] [uri "/mailto:[email protected] "] [unique_id "apBr34cIUkSkDaZLvvSZyQAAACk"], referer: http://TransCapitalSolutions.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-04 09:54:55
(2 months ago)
FortiWeb WAF: 16 attacks detected. Threat Score: 11310180. Types: Client Management(8), Signature Detection(8). Origin: United States.
Web App Attack
🇬🇧
Steve
2026-06-29 01:04:02
(4 months ago)
Forum Spam
Web Spam
🇦🇺
MAGIC
2026-05-29 02:05:10
(5 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-28 20:58:07
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 16:57:59.600219 2026] [security2:error] [pid 4428:tid 4428] [client 191.102.129.133:26025] ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 16:57:59.600219 2026] [security2:error] [pid 4428:tid 4428] [client 191.102.129.133:26025] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "ahisV_0CTIxeOkf7R6U2ZwAAAAQ"], referer: http://www.holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-19 16:21:15
(5 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:19-21.191.102.129.133
Web App Attack
🇺🇸
TPI-Abuse
2026-04-12 05:03:26
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 01:03:19.614518 2026] [security2:error] [pid 3763761:tid 3763761] [client 191.102.129.133: ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 01:03:19.614518 2026] [security2:error] [pid 3763761:tid 3763761] [client 191.102.129.133:26145] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.holgerfeld.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.holgerfeld.com"] [uri "/mailto:[email protected] "] [unique_id "adsnl6PWWVjjGG-Wr7BDQwAAAAM"], referer: http://www.holgerfeld.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-23 01:03:43
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 21:03:35.960775 2026] [security2:error] [pid 15786:tid 15786] [client 191.102.129.133:3908 ...
show more
(mod_security) mod_security (id:210730) triggered by 191.102.129.133 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 21:03:35.960775 2026] [security2:error] [pid 15786:tid 15786] [client 191.102.129.133:39087] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||CapitalSwissCorp.com:80|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "capitalswisscorp.com"] [uri "/mailto:[email protected] "] [unique_id "acCRZ8mFYG-92TitIPDhUwAAAAs"], referer: http://CapitalSwissCorp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
