🇺🇸
TPI-Abuse
2026-11-07 18:31:08
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 102.91.103.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:31:03.598248 2026] [security2:error] [pid 2073677:tid 2073698] [client 102.91.103.251:64 ...
show more
(mod_security) mod_security (id:210350) triggered by 102.91.103.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:31:03.598248 2026] [security2:error] [pid 2073677:tid 2073698] [client 102.91.103.251:64151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bayareajazzandbluesicians.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bayareajazzandbluesicians.com"] [uri "/"] [unique_id "au9uZ2E7pHV8XqqzCurJ2gAAAVA"], referer: https://mailchi.mp/9df3180957ed/art-news-february2020
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Kejult
2026-10-01 15:23:38
UTC ·
(1 month ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
2026-10-01 12:07:46
UTC ·
(1 month ago)
denied traffic to a honeypot network. destination port 445.
Port Scan
Hacking
🇫🇮
6kilowatti
2026-10-01 11:51:05
UTC ·
(1 month ago)
2026-10-01T14:51:04.048097+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=102.91.103.251 DST=83.148.240.21 LEN=52 TOS=0x00 PREC=0x00 TTL=108 ID=21517 DF PROTO=TCP SPT=43570 DPT=445 WINDOW=8192 RES=0x ...
show more
2026-10-01T14:51:04.048097+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=102.91.103.251 DST=83.148.240.21 LEN=52 TOS=0x00 PREC=0x00 TTL=108 ID=21517 DF PROTO=TCP SPT=43570 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇺🇸
鬼影233
2026-09-21 09:53:20
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
2026-07-28 13:15:16
UTC ·
(3 months ago)
Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan) employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/ ...
show more
Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan) employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/3525/form_key/CNOdCjOybWzmNj2h/ | UA: Mozilla/5.0 (iPod; U; CPU iPhone OS 4_3 like Mac OS X; mn-MN) AppleWebKit/532.24.1 (KHTML, like Gecko) Version/4.0.5 Mobile/8B111 Safari/6532.24.1 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇹🇷
oalver
2026-07-24 06:10:17
UTC ·
(3 months ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: honeypot_smb. Sources: honeypot. First seen: 2026-07-24. Risk score: 30/100.
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-06-23 18:27:33
UTC ·
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 102.91.103.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:27:29.582415 2026] [security2:error] [pid 2432:tid 2432] [client 102.91.103.251:35364] M ...
show more
(mod_security) mod_security (id:240335) triggered by 102.91.103.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:27:29.582415 2026] [security2:error] [pid 2432:tid 2432] [client 102.91.103.251:35364] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 102.91.103.251 (+1 hits since last alert)|fusionrep.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fusionrep.com"] [uri "/xmlrpc.php"] [unique_id "ajrQEZpz1fE-z-cfVc9CDwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-23 16:05:10
UTC ·
(4 months ago)
Attac
Brute-Force
🇲🇾
Rizzy
2026-06-23 16:04:35
UTC ·
(4 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
2026-05-03 13:29:23
UTC ·
(6 months ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇩🇪
Ad0lar
2025-10-12 08:00:17
UTC ·
(1 year ago)
ports, 445/24H:1/7D:1
Port Scan
🇵🇱
nfsec.pl
2025-10-07 20:18:24
UTC ·
(1 year ago)
Detected: TCP scan on port: 445 with flags: SYN
Port Scan
🇩🇪
check-the-sum.fr
2025-10-07 17:47:10
UTC ·
(1 year ago)
Port Scanning
Port Scan
🇩🇪
guldkage
2025-10-07 14:19:16
UTC ·
(1 year ago)
Unauthorized connection attempt detected from IP address 102.91.103.251 to port 445 (ger-05) [SMB]
Exploited Host
