🇺🇸
TPI-Abuse
2026-11-13 07:58:46
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:58:39.570967 2026] [security2:error] [pid 6335:tid 6335] [client 103.154.49.238:43598] M ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 02:58:39.570967 2026] [security2:error] [pid 6335:tid 6335] [client 103.154.49.238:43598] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||nyctrademarklawyers.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "nyctrademarklawyers.com"] [uri "/"] [unique_id "avbDL1VRF6NRAOOZ33jx1wAAABs"], referer: https://cinnaliteslimdfder.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
A000Z
2026-11-08 00:25:45
UTC ·
(6 days ago)
Fail2Ban: 103.154.49.238 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0.1 Safari/605.1.15
Bad Web Bot
🇩🇪
nyuuzyou
2026-11-01 17:15:30
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-01T17:15:30Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-01 03:16:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 23:16:15.012357 2026] [security2:error] [pid 4897:tid 4897] [client 103.154.49.238:44654] M ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 23:16:15.012357 2026] [security2:error] [pid 4897:tid 4897] [client 103.154.49.238:44654] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||doorofhopechurch.org|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "doorofhopechurch.org"] [uri "/assets"] [unique_id "auau_9xKhbKvZDwS0sNhVwAAAAI"], referer: https://doorofhopechurch.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 17:55:19
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:55:11.678321 2026] [security2:error] [pid 6012:tid 6012] [client 103.154.49.238:41210] M ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:55:11.678321 2026] [security2:error] [pid 6012:tid 6012] [client 103.154.49.238:41210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||unitedstarsaerospace.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "unitedstarsaerospace.com"] [uri "/"] [unique_id "auI2__tTZ27Fe3GJvX7cCgAAAA4"], referer: https://addurl.in/redirect.php?ref_host=lavindekor.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
AbuseIPDB informer
2026-10-08 10:40:28
UTC ·
(1 month ago)
nfdump top talker: 103.154.49.238 | first seen 2026-10-08 13:40:28.672 | duration 00:00:00.053 | flows=1 | packets=20460 | bytes=15.1 M | pps=384 | bps=2.3 M | bpp=735 | proto=any
DDoS Attack
Port Scan
Exploited Host
🇺🇸
TPI-Abuse
2026-10-03 13:31:03
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:30:56.369909 2026] [security2:error] [pid 15640:tid 15640] [client 103.154.49.238:49710] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.154.49.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:30:56.369909 2026] [security2:error] [pid 15640:tid 15640] [client 103.154.49.238:49710] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lfrmtmorris.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lfrmtmorris.com"] [uri "/"] [unique_id "asEDkAe0g0A_HClVh6lvngAAAAY"], referer: https://linkanalyzer.website/dir/outreach-link-building-121359
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-29 13:08:00
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-28 10:15:44
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-24 13:24:01
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
LRob
2026-09-22 16:25:16
UTC ·
(1 month ago)
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no b ...
show more
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. | path: /marque/4-bergamont | query: q=Cat%C3%A9gories-meilleur+v%C3%A9lo+entre+3000+et+4000+euros-meilleur+v%C3%A9lo+entre+5000+et+10000+euros-V%C3%A9los+%C3%A9lect | 2026-09-22 16:25 UTC
show less
DDoS Attack
Web App Attack
🇺🇸
鬼影233
2026-09-20 17:43:51
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-09-14 13:01:18
UTC ·
(2 months ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=52&topics%5B2%5D=51&topics%5B3%5D=33&topics%5B4%5D=58 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=52&topics%5B2%5D=51&topics%5B3%5D=33&topics%5B4%5D=58 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-08-26 15:41:47
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇳🇱
Tsumugi Kotobuki
2026-08-15 15:07:21
UTC ·
(2 months ago)
Port Scan on Honeypot | Ports: 23/Telnet, 22/SSH | Proto: TCP(2) | Flags: all SYN | TTL: 48 | Len: 60B(2x) | Win: 65535(2) | F2B/ufw-honeypot@2026-08-15T15:07:21Z
Port Scan
Hacking
