🇺🇸
TPI-Abuse
2026-11-08 08:00:18
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 103.124.96.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:00:10.309070 2026] [security2:error] [pid 19442:tid 19442] [client 103.124.96.221:9122] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.124.96.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 03:00:10.309070 2026] [security2:error] [pid 19442:tid 19442] [client 103.124.96.221:9122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||daydar.net|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "daydar.net"] [uri "/"] [unique_id "avAsCne39Hg8B4holUq6xwAAAAg"], referer: https://addurl.in/redirect.php?ref_host=emigracionespanolaard.org.do
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇮
administrator
2026-11-03 23:15:56
UTC ·
(4 days ago)
2026-11-02 14:41:40,655 fail2ban.actions [1471361]: NOTICE [apache-badbots] Ban 103.124.96.221
2026-11-02 14:41:40,655 fail2ban.actions [1471361]: NOTICE [apache-badbots] Ban 103.124.96.221
2026-11-02 14:41:40,655 fail2ban.actions ...
show more
2026-11-02 14:41:40,655 fail2ban.actions [1471361]: NOTICE [apache-badbots] Ban 103.124.96.221
2026-11-02 14:41:40,655 fail2ban.actions [1471361]: NOTICE [apache-badbots] Ban 103.124.96.221
2026-11-02 14:41:40,655 fail2ban.actions [1471361]: NOTICE [apache-badbots] Ban 103.124.96.221
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-11-03 01:10:02
UTC ·
(5 days ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
LRob
2026-10-16 04:41:45
UTC ·
(3 weeks ago)
Calendar filter flood (L7 DDoS) | host: escrime-auvergnerhonealpes.fr | path: http://escrime-auvergnerhonealpes.fr/calendrier-2/action~agenda/time_limit~1763161200/cat_ids~649/tag_ids~442,425,587,609,687,22 | src_port: 61204
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-18 01:02:16
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 103.124.96.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:02:10.001046 2026] [security2:error] [pid 26895:tid 26895] [client 103.124.96.221:45711] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.124.96.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:02:10.001046 2026] [security2:error] [pid 26895:tid 26895] [client 103.124.96.221:45711] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bookingsouthafrica.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bookingsouthafrica.com"] [uri "/403.shtml"] [unique_id "aqyNkVVGCw7HphI7OcWnMwAAAAs"], referer: https://infojeffreysbay.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-02 08:01:05
UTC ·
(2 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 17:22:50
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇳🇱
EGP Abuse Dept
2026-08-20 02:29:24
UTC ·
(2 months ago)
Unauthorized connection to SSH port 22
Port Scan
Hacking
SSH
🇩🇪
Ilop
2026-08-20 00:10:10
UTC ·
(2 months ago)
[hp-100] 2 unsolicited packets to honeypot ports 22 (OCI DShield sensor)
Port Scan
🇫🇷
Zkillu
2026-08-19 22:11:54
UTC ·
(2 months ago)
UDP flood (DDoS) vs AS215599: 3447 pkts / 4.93 MB to UDP 80/8443 across 288 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised h ...
show more
UDP flood (DDoS) vs AS215599: 3447 pkts / 4.93 MB to UDP 80/8443 across 288 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
🇫🇷
HaloAgencySAS
2026-08-19 22:11:54
UTC ·
(2 months ago)
UDP flood (DDoS) vs AS215599: 3447 pkts / 4.93 MB to UDP 80/8443 across 288 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised h ...
show more
UDP flood (DDoS) vs AS215599: 3447 pkts / 4.93 MB to UDP 80/8443 across 288 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
🇩🇪
ghostwarriors
2026-08-19 18:20:22
UTC ·
(2 months ago)
Unauthorized connection attempt detected, SSH Brute-Force
Brute-Force
Port Scan
SSH
2026-07-23 07:14:39
UTC ·
(3 months ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇷🇴
INTEQ
2026-03-27 22:05:11
UTC ·
(7 months ago)
Web attack from 103.124.96.221
Web App Attack
🇺🇸
kosada.com
2026-03-09 01:41:56
UTC ·
(7 months ago)
IMAP password guessing
Brute-Force
