🇺🇸
TPI-Abuse
2026-11-12 20:12:55
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:12:50.053199 2026] [security2:error] [pid 9967:tid 9967] [client 116.193.219.1:44132] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:12:50.053199 2026] [security2:error] [pid 9967:tid 9967] [client 116.193.219.1:44132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||missingfilm.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "missingfilm.com"] [uri "/"] [unique_id "avYdwrjqwRZS0RhhamR5SAAAABw"], referer: https://thirdbanana.blogspot.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-11-12 05:23:42
UTC ·
(1 day ago)
Wordpress malicious attack:[octaflood]
Web App Attack
🇩🇪
nyuuzyou
2026-11-04 11:47:08
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-04T11:47:08Z.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-02 08:40:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:40:53.100673 2026] [security2:error] [pid 29029:tid 29029] [client 116.193.219.1:56028] M ...
show more
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:40:53.100673 2026] [security2:error] [pid 29029:tid 29029] [client 116.193.219.1:56028] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||samimartin.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "samimartin.com"] [uri "/musings/category/lifestyle"] [unique_id "auhMlaGTMSTK3J9gZxb48QAAADg"], referer: https://samimartin.com/musings/wellness/hate-is-an-ugly-thing
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 20:40:22
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 16:40:17.784831 2026] [security2:error] [pid 8018:tid 8018] [client 116.193.219.1:52044] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 116.193.219.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 16:40:17.784831 2026] [security2:error] [pid 8018:tid 8018] [client 116.193.219.1:52044] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||bookingsouthafrica.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bookingsouthafrica.com"] [uri "/"] [unique_id "auEMMdbLJAIKZJ8Nv5lqQQAAAA8"], referer: https://allafricaadventures.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
bigorre.org
2026-10-11 07:01:09
UTC ·
(1 month ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
鬼影233
2026-10-02 11:02:30
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-10-02 09:01:33
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
SX Communications
2026-10-01 14:00:12
UTC ·
(1 month ago)
Web vulnerability scanning / probing from 116.193.219.1: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 1 hits; paths: /cdn-cgi/rum.
Port Scan
Hacking
Web App Attack
🇺🇸
鬼影233
2026-10-01 10:31:42
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
LRob
2026-09-26 20:31:55
UTC ·
(1 month ago)
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no b ...
show more
This address is taking part in a large-scale, distributed L7 DDoS against an online shop: automated requests to the shop's search, filter and sort pages — the most expensive pages to serve — sent with no referer and with no page asset loaded, so no browser is behind them. Each participating address sends only one or two such requests, but we count them by the million: a botnet, compromised devices, or abused proxies. The address is blocked. An investigation into what exactly sends these requests from your network (malware, an open proxy, a rented device) would help stop the attack at its source. | path: /181-velo-route | query: q=Taille-XL-XS&order=product.reference.desc | 2026-09-26 20:31 UTC
show less
DDoS Attack
Web App Attack
🇩🇪
jbcrn
2026-09-22 10:24:02
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Aggressive maze explorers, ruleset: generated-url. Requested honeypot path: /blog/deflagration.melopoeic/executrixship-vulnerably/Al/dodecagonal/sleepiness/. User-Agent: Mozilla/5.0 (Macint ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Aggressive maze explorers, ruleset: generated-url. Requested honeypot path: /blog/deflagration.melopoeic/executrixship-vulnerably/Al/dodecagonal/sleepiness/. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇺🇸
鬼影233
2026-09-22 03:11:33
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Bad Web Bot
🇺🇸
kosada.com
2026-09-21 13:30:55
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=54&topics%5B3%5D=62&topics%5B4%5D=25&topics%5B5%5D=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/6 ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B2%5D=54&topics%5B3%5D=62&topics%5B4%5D=25&topics%5B5%5D=63 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0.1 Safari/605.1.15")
show less
DDoS Attack
Bad Web Bot
🇺🇸
鬼影233
2026-09-16 15:08:18
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
