🇺🇸
TPI-Abuse
2026-11-07 23:37:26
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:37:20.928194 2026] [security2:error] [pid 21905:tid 21905] [client ...
show more
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:37:20.928194 2026] [security2:error] [pid 21905:tid 21905] [client 103.237.36.70:33056] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||anenchantingevening.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "anenchantingevening.com"] [uri "/"] [unique_id "au-2MOngxHKpDVSjOdNSHgAAABs"], referer: https://psenzeees.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 02:58:20
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:58:13.762431 2026] [security2:error] [pid 15062:tid 15062] [client ...
show more
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:58:13.762431 2026] [security2:error] [pid 15062:tid 15062] [client 103.237.36.70:36524] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lapetitegrooming.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lapetitegrooming.com"] [uri "/sitemap1.xml"] [unique_id "auvwxcnuQ7qek7ssb4xeVAAAAAM"], referer: https://lapetitegrooming.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 14:51:28
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:51:21.962270 2026] [security2:error] [pid 1470462:tid 1470479] [cli ...
show more
(mod_security) mod_security (id:210350) triggered by 103.237.36.70 (103.237.36-70.antbd.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:51:21.962270 2026] [security2:error] [pid 1470462:tid 1470479] [client 103.237.36.70:36948] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||royaleconomicsacademy.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "royaleconomicsacademy.com"] [uri "/"] [unique_id "auijaY9Ennu9WPzfk0ENjwAAAU4"], referer: https://royalbusinesscollege.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-10-17 15:24:17
UTC ·
(3 weeks ago)
xmlrpc exploit on careenough.us/xmlrpc.php — WellSpr.ing/NetSentinel civic-AI security layer
Brute-Force
Web App Attack
🇺🇸
鬼影233
2026-09-30 14:51:53
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
鬼影233
2026-09-29 12:13:39
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
kosada.com
2026-09-21 03:07:35
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=33&topics%5B2%5D=25&topics%5B3%5D=29&topics%5B4%5D=42 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=33&topics%5B2%5D=25&topics%5B3%5D=29&topics%5B4%5D=42 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36")
show less
DDoS Attack
Bad Web Bot
🇫🇷
bigorre.org
2026-09-12 15:32:38
UTC ·
(1 month ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇦🇹
urnilxfgbez
2026-09-03 22:45:00
UTC ·
(2 months ago)
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
Port Scan
🇩🇪
Kitki30.com
2026-09-03 13:57:06
UTC ·
(2 months ago)
Entered Telnet Tarpit (endlessh, server 3).
Log: 2026-09-03T13:57:05.725Z ACCEPT host=::ffff:103.237.36.70 port=36516 fd=48 n=46/4096
IoT Targeted
Port Scan
Brute-Force
2026-09-03 09:41:42
UTC ·
(2 months ago)
denied Telnet access attempt. destination port 23.
Port Scan
Brute-Force
🇺🇸
kosada.com
2026-08-31 13:40:48
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-08-27 06:16:00
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
EGP Abuse Dept
2026-08-09 03:25:14
UTC ·
(3 months ago)
Scraping webshop URLs (www.ngs.nl), likely botnet drone
Bad Web Bot
Exploited Host
🇩🇪
LRob
2026-08-06 16:03:47
UTC ·
(3 months ago)
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763766000/cat_ids~196,174,152/tag_ids~4 ...
show more
CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763766000/cat_ids~196,174,152/tag_ids~488,639,491,754,478,485/request_format~json/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
