🇺🇸
TPI-Abuse
2026-11-12 20:25:57
UTC ·
(22 hours ago)
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:25:40.052129 2026] [security2:error] [pid 14808:tid 14927] [client 110.76.128.146:38514] ...
show more
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:25:40.052129 2026] [security2:error] [pid 14808:tid 14927] [client 110.76.128.146:38514] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||certifiedprojectmanager.net|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "certifiedprojectmanager.net"] [uri "/"] [unique_id "avYgxDnIfNx2oO_cLYEnSAAAAcY"], referer: https://royalbusinesscollege.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-10 21:56:25
UTC ·
(2 days ago)
Try to access /xmlrpc.php
Web App Attack
2026-11-10 20:16:32
UTC ·
(2 days ago)
110.76.128.146 - - [11/Nov/2026:04:16:31 +0800] "POST /xmlrpc.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
...
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-11-09 00:16:07
UTC ·
(4 days ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B3%5D=56&topics%5B4%5D=67&topics%5B5%5D=43&topics%5B6%5D=65 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/6 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B3%5D=56&topics%5B4%5D=67&topics%5B5%5D=43&topics%5B6%5D=65 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-07 21:16:45
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 16:16:31.382423 2026] [security2:error] [pid 9960:tid 9960] [client 110.76.128.146:13001] M ...
show more
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 16:16:31.382423 2026] [security2:error] [pid 9960:tid 9960] [client 110.76.128.146:13001] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||awesomeenergyrecords.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "awesomeenergyrecords.com"] [uri "/"] [unique_id "au-VL8iMTCuDwu-GeZE-5QAAAB4"], referer: https://listmyhostlikedas.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-11-06 01:10:01
UTC ·
(1 week ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
2026-11-04 05:15:03
UTC ·
(1 week ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /communications/shopby/manufacturer-polycom-lifesize-aastra-netgear-dis-bxb-sony-avaya-xclaim-fortinet-huawei.html | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
2026-10-25 00:00:00
UTC ·
(2 weeks ago)
Excess traffic against library thesis application impacting production services
Brute-Force
🇳🇱
maxxsense
2026-10-10 19:32:43
UTC ·
(1 month ago)
(postfix-unknown) Failed postfix unknown login with username [redacted] from 110.76.128.146 (BD/Bangladesh/-)
Hacking
2026-10-10 15:33:59
UTC ·
(1 month ago)
SMTP brute force - auth failed
Brute-Force
Exploited Host
🇮🇹
www.tana.it
2026-10-10 15:33:16
UTC ·
(1 month ago)
SMTP auth dictionary attack
Brute-Force
🇫🇷
Stara
2026-10-10 12:57:19
UTC ·
(1 month ago)
Distributed smtpauth, imapd and ftp login attacks or more than 2 temp blocks in the last 259200 secs
Brute-Force
DDoS Attack
🇺🇸
鬼影233
2026-10-01 14:28:20
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-29 23:59:46
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:59:38.315829 2026] [security2:error] [pid 27475:tid 27507] [client 110.76.128.146:44128] ...
show more
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:59:38.315829 2026] [security2:error] [pid 27475:tid 27507] [client 110.76.128.146:44128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||howardhallis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "howardhallis.com"] [uri "/doctorstrange"] [unique_id "arxQ6mPybf0DxqWVYt6aNAAAAEE"], referer: https://neilalien.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-28 09:55:24
UTC ·
(1 month ago)
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 05:55:15.142052 2026] [security2:error] [pid 32525:tid 32525] [client 110.76.128.146:35866] ...
show more
(mod_security) mod_security (id:210350) triggered by 110.76.128.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 05:55:15.142052 2026] [security2:error] [pid 32525:tid 32525] [client 110.76.128.146:35866] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ismaelcavazos.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ismaelcavazos.com"] [uri "/"] [unique_id "aro5g9e5FeG4ZOGmYPr1QgAAAAU"], referer: https://addurl.in/redirect.php?ref_host=ngtakiguzellik.com
show less
Brute-Force
Bad Web Bot
Web App Attack
