🇺🇸
TPI-Abuse
2026-11-07 14:43:53
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:43:47.147078 2026] [security2:error] [pid 16973:tid 16973] [client 103.154.236.121:4468 ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 09:43:47.147078 2026] [security2:error] [pid 16973:tid 16973] [client 103.154.236.121:44680] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||hacertests.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "hacertests.com"] [uri "/examenes-185491-biologia_1_bachillerato.php"] [unique_id "au85I7xZq3Jt1lH7pJcI6AAAABI"], referer: https://hacertests.com/examenes-188102-biologia_temario_ceneval.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyuuzyou
2026-11-05 10:29:28
UTC ·
(3 days ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T10:29:28Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-04 11:23:27
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 06:23:23.623860 2026] [security2:error] [pid 22012:tid 22012] [client 103.154.236.121:5959 ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 06:23:23.623860 2026] [security2:error] [pid 22012:tid 22012] [client 103.154.236.121:59590] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sabri.es|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sabri.es"] [uri "/"] [unique_id "ausVqzb-n1z9KfxddJ-PhAAAAAQ"], referer: https://sukartoen.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-30 06:20:22
UTC ·
(1 week ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-12 17:06:30
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 13:06:24.401213 2026] [security2:error] [pid 3216:tid 3216] [client 103.154.236.121:47592] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 13:06:24.401213 2026] [security2:error] [pid 3216:tid 3216] [client 103.154.236.121:47592] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||calstarsfarm.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "calstarsfarm.com"] [uri "/"] [unique_id "as0TkMf4NKM0m_Z-bZnshgAAACQ"], referer: https://each.co.in/redirect.php?ref_host=thesudbury.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-10-01 14:29:10
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-01 13:43:54
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-01 02:37:50
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 22:37:42.214079 2026] [security2:error] [pid 24128:tid 24135] [client 103.154.236.121:5108 ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 22:37:42.214079 2026] [security2:error] [pid 24128:tid 24135] [client 103.154.236.121:51086] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||universalpeacecongress.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "universalpeacecongress.com"] [uri "/"] [unique_id "ar3HdvyKPNl1cTQOz-AyrAAAAQU"], referer: https://makefreebacklinks.site/dir/premium-backlink-services-221714
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-29 04:55:51
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-26 15:14:19
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 08:50:00
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
LRob
2026-09-22 16:05:40
UTC ·
(1 month ago)
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no b ...
show more
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. | path: /4-velos-electriques | query: q=Famille-E%5C-Cargoville-Sinus-HYBE | 2026-09-22 16:05 UTC
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-09-21 07:51:42
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=28&topics%5B2%5D=89&topics%5B3%5D=50&topics%5B4%5D=34 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=28&topics%5B2%5D=89&topics%5B3%5D=50&topics%5B4%5D=34 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-09-21 05:12:24
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-17 02:42:34
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:42:28.150363 2026] [security2:error] [pid 4050:tid 4050] [client 103.154.236.121:46694] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.236.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:42:28.150363 2026] [security2:error] [pid 4050:tid 4050] [client 103.154.236.121:46694] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.damonmarks.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.damonmarks.com"] [uri "/403.shtml"] [unique_id "aqtTlCgW6JGWpGptldu2kQAAAAY"], referer: https://searchrankingchecker.site/dir/quality-link-building-50109
show less
Brute-Force
Bad Web Bot
Web App Attack
