🇺🇸
TPI-Abuse
2026-11-07 22:37:22
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:37:19.352721 2026] [security2:error] [pid 29531:tid 29531] [client 103.138.214.70:39080] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:37:19.352721 2026] [security2:error] [pid 29531:tid 29531] [client 103.138.214.70:39080] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||charlestownmarina.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "charlestownmarina.com"] [uri "/"] [unique_id "au-oH8IGW5iExHSAlvp5RAAAABg"], referer: https://cliffnealelimzdfg.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 11:25:59
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 06:25:56.751665 2026] [security2:error] [pid 6933:tid 6933] [client 103.138.214.70:22194] M ...
show more
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 06:25:56.751665 2026] [security2:error] [pid 6933:tid 6933] [client 103.138.214.70:22194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||thecalls.net|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thecalls.net"] [uri "/"] [unique_id "au8KxEKTK2c2EGQwNqDxzAAAAAo"], referer: https://aplicabbs.com/all/2869/13.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyuuzyou
2026-11-03 12:17:53
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-03T12:17:53Z.
Bad Web Bot
🇫🇷
bigorre.org
2026-11-03 06:44:55
UTC ·
(1 week ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-31 14:17:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 10:17:26.195333 2026] [security2:error] [pid 13080:tid 13080] [client 103.138.214.70:37132] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 10:17:26.195333 2026] [security2:error] [pid 13080:tid 13080] [client 103.138.214.70:37132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||billhumphreyresearch.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "billhumphreyresearch.com"] [uri "/"] [unique_id "auX4djNFOshGLAPdmJ8zdQAAAAc"], referer: https://billhumphrey.org/about-bill
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
georgengelmann
2026-10-30 14:38:39
UTC ·
(2 weeks ago)
Failed login attempt for pedro
Brute-Force
Web App Attack
🇨🇿
lp
2026-10-30 14:18:04
UTC ·
(2 weeks ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 103.138.214.70
2026-10-30T14:58:09+0100 vpn Access-Reject station: 103.138.214.70
Brute-Force
Web App Attack
🇫🇷
bigorre.org
2026-10-22 15:13:11
UTC ·
(3 weeks ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇫🇷
bigorre.org
2026-10-19 17:04:31
UTC ·
(3 weeks ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-17 14:32:54
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:225170) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 10:32:48.179953 2026] [security2:error] [pid 10746:tid 10746] [client 103.138.214.70:56576] ...
show more
(mod_security) mod_security (id:225170) triggered by 103.138.214.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 10:32:48.179953 2026] [security2:error] [pid 10746:tid 10746] [client 103.138.214.70:56576] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.investlocalnm.socialenterprise.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.investlocalnm.socialenterprise.net"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atOHEML0VPTO9E5DRhGmUgAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-11 03:05:29
UTC ·
(1 month ago)
Captured JA4H: ge11n_133fd66ef233 | Log: 103.138.214.70 - - [11/Oct/2026:10:05:18 +0700] "GET / HTTP/1.1" 200 17130 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.143 ...
show more
Captured JA4H: ge11n_133fd66ef233 | Log: 103.138.214.70 - - [11/Oct/2026:10:05:18 +0700] "GET / HTTP/1.1" 200 17130 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.143 Safari/537.36 OPR/119.0.5481.0" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,upgrade-insecure-requests,cf-ew-via,cdn-loop,sec-fetch-user,sec-fetch-site,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-mode,cf-visitor,sec-fetch-dest,priority,save-data,sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,cf-ipcountry...
...
show less
Email Spam
Hacking
🇺🇸
鬼影233
2026-10-01 18:40:06
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
