🇺🇸
TPI-Abuse
2026-11-07 15:35:56
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210350) triggered by 103.94.216.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 10:35:50.798018 2026] [security2:error] [pid 15239:tid 15239] [client 103.94.216.139:45424] ...
show more
(mod_security) mod_security (id:210350) triggered by 103.94.216.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 10:35:50.798018 2026] [security2:error] [pid 15239:tid 15239] [client 103.94.216.139:45424] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||acarsubscription.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "acarsubscription.com"] [uri "/"] [unique_id "au9FVpiAYjVea0x3XC8TlQAAADo"], referer: https://acarsubscription.com/car-subscription-los-angeles
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-07 11:11:20
UTC ·
(19 hours ago)
Web app attack and vulnerability scan detected from IIS logs
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-10-31 16:50:55
UTC ·
(1 week ago)
Probing websites for vulnerabilities
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-26 10:43:10
UTC ·
(1 week ago)
dance4fitness.com.au:443 103.94.216.139 - - [26/Oct/2026:21:43:08 +1100] "GET /wp/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 HTTP/1.1" 404 67854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/15 ...
show more
dance4fitness.com.au:443 103.94.216.139 - - [26/Oct/2026:21:43:08 +1100] "GET /wp/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 HTTP/1.1" 404 67854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇫🇷
bigorre.org
2026-10-25 17:03:57
UTC ·
(1 week ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-24 08:10:11
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:225170) triggered by 103.94.216.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:10:03.832513 2026] [security2:error] [pid 22721:tid 22721] [client 103.94.216.139:53706] ...
show more
(mod_security) mod_security (id:225170) triggered by 103.94.216.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:10:03.832513 2026] [security2:error] [pid 22721:tid 22721] [client 103.94.216.139:53706] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||knowyourcode.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "knowyourcode.us"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atxn22kQSAURCvU08-xJQAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-11 18:58:26
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
LRob
2026-08-05 21:10:39
UTC ·
(3 months ago)
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~144,184,149/tag_ids~717,677,326,615,219,618/request_format~json/ | UA: ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~144,184,149/tag_ids~717,677,326,615,219,618/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
MPL
2026-08-05 07:55:25
UTC ·
(3 months ago)
tcp/23
Port Scan
🇩🇪
LRob
2026-08-05 04:09:35
UTC ·
(3 months ago)
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/page_offset~1/cat_ids~299,192/tag_ids~621,618,576,631,220,433/request_format~json/ | UA: Mozilla/5.0 ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/page_offset~1/cat_ids~299,192/tag_ids~621,618,576,631,220,433/request_format~json/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-08-02 08:25:49
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-31 12:33:27
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-07-23 17:14:08
UTC ·
(3 months ago)
denied traffic to a honeypot network. destination port 21444.
Port Scan
Hacking
2026-06-18 15:10:26
UTC ·
(4 months ago)
DNS Compromise
DDoS Attack
🇯🇵
Valhalla
2026-06-12 11:20:24
UTC ·
(4 months ago)
/xmlrpc.php
Hacking
Web App Attack
