🇺🇸
TPI-Abuse
2026-11-08 09:16:28
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:16:23.316090 2026] [security2:error] [pid 8044:tid 8044] [ ...
show more
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:16:23.316090 2026] [security2:error] [pid 8044:tid 8044] [client 103.103.35.121:55688] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aholsniffsglue.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aholsniffsglue.com"] [uri "/"] [unique_id "avA956LPh4PaKkG2OTWfrwAAAAw"], referer: https://paintingcans.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 04:09:00
UTC ·
(16 hours ago)
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:08:47.956960 2026] [security2:error] [pid 24416:tid 24416] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:08:47.956960 2026] [security2:error] [pid 24416:tid 24416] [client 103.103.35.121:39228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||calvarycavaliers.org|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "calvarycavaliers.org"] [uri "/cbea"] [unique_id "au_1z-1llqtoN9i9QwdtAAAAAAg"], referer: https://calvaryshreveport.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 14:56:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 10:56:28.112807 2026] [security2:error] [pid 9015:tid 9015] [ ...
show more
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 10:56:28.112807 2026] [security2:error] [pid 9015:tid 9015] [client 103.103.35.121:35106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||watsonstentsandevents.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "watsonstentsandevents.com"] [uri "/"] [unique_id "auYBnG4rywGKJ9fR3sr2YQAAAAk"], referer: https://five.co.in/redirect.php?ref_host=precisionmarketing-hub.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 05:40:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 01:40:18.638500 2026] [security2:error] [pid 7817:tid 7817] [ ...
show more
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 01:40:18.638500 2026] [security2:error] [pid 7817:tid 7817] [client 103.103.35.121:39074] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sweetsixteennapkins.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sweetsixteennapkins.com"] [uri "/"] [unique_id "auQtwuSB9_OypNOUJu5-VQAAAAI"], referer: https://five.co.in/redirect.php?ref_host=crsgp.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 15:29:00
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 11:28:55.703496 2026] [security2:error] [pid 4600:tid 4600] [ ...
show more
(mod_security) mod_security (id:210350) triggered by 103.103.35.121 (host-121-35-103-103.xlinkbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 11:28:55.703496 2026] [security2:error] [pid 4600:tid 4600] [client 103.103.35.121:50992] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||niseigroup.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "niseigroup.com"] [uri "/"] [unique_id "at4gN-9N2CD8IlrJCzCghwAAAC0"], referer: https://acquire.co.in/redirect.php?ref_host=physical-therapist6.club
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-16 16:30:35
UTC ·
(3 weeks ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /communications/shopby/manufacturer-cisco-lifesize-aastra-grandstream-snom-netgear-hp-crestron-rcf-sony-xclaim-fortinet-spectralink.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇩🇪
netclix.gr
2026-10-11 01:30:42
UTC ·
(4 weeks ago)
(fake_mac) Blocked fake Macintosh Chrome 103.103.35.121 (BD/Bangladesh/host-121-35-103-103.xlinkbd.net)
Hacking
🇺🇸
kosada.com
2026-10-08 14:22:33
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=62&topics%5B3%5D=66&topics%5B4%5D=54&topics%5B5%5D=34 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=62&topics%5B3%5D=66&topics%5B4%5D=54&topics%5B5%5D=34 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 15:24:56
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-30 10:45:41
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 10:27:35
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-28 09:37:03
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Bad Web Bot
🇩🇪
LRob
2026-09-26 17:50:19
UTC ·
(1 month ago)
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no b ...
show more
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. | path: /marque/2-scott | query: q=Famille-Gambler-Lumen-Patron-Speedster+Gravel-Metrix+eRIDE | 2026-09-26 17:50 UTC
show less
DDoS Attack
Web App Attack
🇺🇸
鬼影233
2026-09-24 06:09:38
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-09-23 11:30:08
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=52&topics%5B2%5D=63&topics%5B3%5D=28&topics%5B4%5D=30 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=52&topics%5B2%5D=63&topics%5B3%5D=28&topics%5B4%5D=30 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
