🇫🇷
Octopuce
2026-08-10 05:20:26
UTC ·
(3 months ago)
Aggressive web search of vulnerable pages: /.env /.env.local /api/.env /backend/.env /config/.env ...
Web App Attack
🇺🇸
TPI-Abuse
2026-08-01 05:12:22
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 01:12:14.361188 2026] [security2:error] [pid 21450:tid 21450] [client 104.28.161.7:33555] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 01:12:14.361188 2026] [security2:error] [pid 21450:tid 21450] [client 104.28.161.7:33555] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lexingtonlimobus.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lexingtonlimobus.com"] [uri "/"] [unique_id "am2ALm9S2utWGDBjqPzCogAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 05:46:42
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 01:46:35.905076 2026] [security2:error] [pid 3464514:tid 3464514] [client 104.28.161.7:19709] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 01:46:35.905076 2026] [security2:error] [pid 3464514:tid 3464514] [client 104.28.161.7:19709] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rlharmongroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rlharmongroup.com"] [uri "/"] [unique_id "amL8O6paPHlAYASldo4NugAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 12:55:07
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 08:55:00.412186 2026] [security2:error] [pid 10839:tid 10897] [client 104.28.161.7:32460] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 08:55:00.412186 2026] [security2:error] [pid 10839:tid 10897] [client 104.28.161.7:32460] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ejspizzeriahudson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ejspizzeriahudson.com"] [uri "/"] [unique_id "al4apPu8Z0Hh0qEsMJNDxwAAAdY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 11:12:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:12:18.795659 2026] [security2:error] [pid 20146:tid 20146] [client 104.28.161.7:33347] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:12:18.795659 2026] [security2:error] [pid 20146:tid 20146] [client 104.28.161.7:33347] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aandsmetal.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aandsmetal.com"] [uri "/"] [unique_id "al4Ckis-5bg6Tb5oRMAFKAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 03:45:52
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 23:45:44.498846 2026] [security2:error] [pid 1497:tid 1497] [client 104.28.161.7:20032] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 23:45:44.498846 2026] [security2:error] [pid 1497:tid 1497] [client 104.28.161.7:20032] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cityindustries.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cityindustries.com"] [uri "/"] [unique_id "al2Z6Lml7-BnFvvB67cnaAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 03:28:45
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 23:28:42.666689 2026] [security2:error] [pid 2451949:tid 2451949] [client 104.28.161.7:19939] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 23:28:42.666689 2026] [security2:error] [pid 2451949:tid 2451949] [client 104.28.161.7:19939] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||randyshelly.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "randyshelly.com"] [uri "/"] [unique_id "al2V6vi4-xmRLbSLRoUAEQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 02:52:50
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:52:42.023848 2026] [security2:error] [pid 7191:tid 7191] [client 104.28.161.7:21570] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:52:42.023848 2026] [security2:error] [pid 7191:tid 7191] [client 104.28.161.7:21570] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||meierstavern.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "meierstavern.com"] [uri "/"] [unique_id "al2NeqjsthJt4nZxhBQYkQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-20 02:27:05
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:26:58.935378 2026] [security2:error] [pid 558007:tid 558007] [client 104.28.161.7:20206] M ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:26:58.935378 2026] [security2:error] [pid 558007:tid 558007] [client 104.28.161.7:20206] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kunzteam.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kunzteam.com"] [uri "/"] [unique_id "al2HcmDrYeN98JZryCnkRAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 22:33:37
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 18:33:31.002271 2026] [security2:error] [pid 15484:tid 15484] [client 104.28.161.7:21786] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 18:33:31.002271 2026] [security2:error] [pid 15484:tid 15484] [client 104.28.161.7:21786] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||themediaplanet.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "themediaplanet.com"] [uri "/"] [unique_id "alqtu0uUvledYahYx2as_QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 22:09:31
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 18:09:25.260358 2026] [security2:error] [pid 1255818:tid 1255818] [client 104.28.161.7:20607] ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 18:09:25.260358 2026] [security2:error] [pid 1255818:tid 1255818] [client 104.28.161.7:20607] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||guardmagic.eu|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "guardmagic.eu"] [uri "/"] [unique_id "alqoFc3yKLG0MbkaQdP0yAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 21:21:25
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 17:21:20.988954 2026] [security2:error] [pid 983724:tid 983724] [client 104.28.161.7:20733] M ...
show more
(mod_security) mod_security (id:210350) triggered by 104.28.161.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 17:21:20.988954 2026] [security2:error] [pid 983724:tid 983724] [client 104.28.161.7:20733] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||californiarhythmproject.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "californiarhythmproject.org"] [uri "/"] [unique_id "alqc0Aa0msj9tQPC3lpZrgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-07-12 03:02:13
UTC ·
(4 months ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇺🇸
xmission.com
2026-05-18 21:25:52
UTC ·
(5 months ago)
Blocked by UFW (TCP on 123)
Source port: 9773
TTL: 57
Packet length: 60
TOS: 0x00
This report (for 104.28.161.7) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇦🇺
FEWA
2026-05-09 18:28:19
UTC ·
(6 months ago)
Fail2Ban Ban Triggered
Hacking
Bad Web Bot
Web App Attack