🇺🇸
Zandro
2026-11-14 04:00:14
UTC ·
(1 day ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇩🇪
tall1oN
2026-11-13 15:00:02
UTC ·
(2 days ago)
104.245.243.187 - - [13/Nov/2026:15:59:59 +0100] "HEAD /wp-admin/ HTTP/2.0" 200 0 "http://diamondliferp.de" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36" "diamondliferp.cc"
104.245 ...
show more
104.245.243.187 - - [13/Nov/2026:15:59:59 +0100] "HEAD /wp-admin/ HTTP/2.0" 200 0 "http://diamondliferp.de" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36" "diamondliferp.cc"
104.245.243.187 - - [13/Nov/2026:16:00:01 +0100] "HEAD /wp-login.php HTTP/2.0" 200 0 "http://diamondliferp.de" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36" "diamondliferp.cc"
...
show less
Web App Attack
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-11-12 08:46:17
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 03:46:02.716369 2026] [security2:error] [pid 5886:tid 5886] [client 104.245.243.187:12035] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 03:46:02.716369 2026] [security2:error] [pid 5886:tid 5886] [client 104.245.243.187:12035] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||enfiestate.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "enfiestate.com"] [uri "/env.php"] [unique_id "avV8ylZzoM5yS8-gLSjcSgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-11 08:17:57
UTC ·
(4 days ago)
"HEAD /wp-admin/ HTTP/1.1"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 10:33:03
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 05:32:47.569223 2026] [security2:error] [pid 29500:tid 29500] [client 104.245.243.187:3675 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 05:32:47.569223 2026] [security2:error] [pid 29500:tid 29500] [client 104.245.243.187:36751] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/author/nateyeo/page/24/"] [unique_id "auhmzwMC-zRixanov7CGcgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 01:56:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 21:55:48.494550 2026] [security2:error] [pid 18090:tid 18090] [client 104.245.243.187:4284 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 21:55:48.494550 2026] [security2:error] [pid 18090:tid 18090] [client 104.245.243.187:42841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||notepromd.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "notepromd.com"] [uri "/index.html"] [unique_id "auP5JMSCHTNSnnOjdOBMBwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 00:36:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 20:36:32.487679 2026] [security2:error] [pid 29082:tid 29082] [client 104.245.243.187:4146 ...
show more
(mod_security) mod_security (id:210350) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 20:36:32.487679 2026] [security2:error] [pid 29082:tid 29082] [client 104.245.243.187:41463] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||weirdlovemakers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "weirdlovemakers.com"] [uri "/sxsw_achron.html"] [unique_id "auKVEJTl_qGJemo8RDvAngAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
sandra361
2026-10-07 10:27:31
UTC ·
(1 month ago)
Port scan detected: 10 attempts across 1 port (8101). | Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=104.245.243.187 LEN=40 TOS=0x00 PREC=0x00 TTL=117 ID=25477 DF PROTO=TCP SPT=61139 DPT=8101 WINDOW=42340 RES=0x00 ACK FIN URGP=0
Port Scan
🇺🇸
TPI-Abuse
2026-10-05 15:16:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:15:57.701759 2026] [security2:error] [pid 9821:tid 9821] [client 104.245.243.187:56015] ...
show more
(mod_security) mod_security (id:210730) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 11:15:57.701759 2026] [security2:error] [pid 9821:tid 9821] [client 104.245.243.187:56015] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Churchill II Recliner/Art Burl/originals/Thumbs.db"] [unique_id "asO_LSO8Yuu3wBZkCV5eUQAAAAc"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Churchill%20II%20Recliner/Art%20Burl/originals/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-10-04 15:41:25
UTC ·
(1 month ago)
Impersonating Good bots
Bad Web Bot
🇺🇸
Bankbook8585
2026-09-24 03:08:30
UTC ·
(1 month ago)
T-Pot honeypot | Dionaea honeypot: mssqld
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-08-24 16:57:11
UTC ·
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 12:56:57.325561 2026] [security2:error] [pid 12207:tid 12207] [client 104.245.243.187:3894 ...
show more
(mod_security) mod_security (id:210730) triggered by 104.245.243.187 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 12:56:57.325561 2026] [security2:error] [pid 12207:tid 12207] [client 104.245.243.187:38941] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Kristin/Thumbs.db"] [unique_id "aox32SgoJbOy2a-j8eOt_AAAABU"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Kristin/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-08-23 21:43:22
UTC ·
(2 months ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after locale-probe / error-handler fuzzing against ASP.NET shop. Evidence: LOCALE-PROBE: MissingSlash (/de17848de/Products/Details/EaudeParfumWomen54DE/)
Hacking
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-07-23 06:32:26
UTC ·
(3 months ago)
HTTP application-layer DoS / botnet traffic from 104.245.243.187: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇩🇪
HandyTreff.de
2026-06-23 04:27:34
UTC ·
(4 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -44.27 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.1172.1
Web App Attack
Bad Web Bot
