2026-02-16 01:36:25
(3 months ago)
2026-02-16T02:36:24.047802+01:00 gollum postfix/smtpd[2356912]: warning: unknown[118.107.3.221]: SAS ...
show more
2026-02-16T02:36:24.047802+01:00 gollum postfix/smtpd[2356912]: warning: unknown[118.107.3.221]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-02-16T02:36:24.656392+01:00 gollum postfix/smtpd[2356912]: lost connection after AUTH from unknown[118.107.3.221]
2026-02-16T02:36:24.656553+01:00 gollum postfix/smtpd[2356912]: disconnect from unknown[118.107.3.221] ehlo=2 starttls=1 auth=0/1 commands=3/4
...
show less
DDoS Attack
Brute-Force
🇺🇸
oncord
2026-02-14 23:13:17
(4 months ago)
Form spam
Web Spam
🇧🇷
hostseries
2026-02-14 14:40:59
(4 months ago)
Trigger: LF_DISTATTACK
Brute-Force
🇵🇱
sefinek.net
2026-02-14 10:57:21
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (G ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: /genshin-stella-mod | UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-02-14 05:00:16
(4 months ago)
BruteForce IMAP/POP3/SMTP
Brute-Force
🇮🇹
VHosting
2026-02-13 23:20:00
(4 months ago)
Detected mail brute force attack from 4 different servers
Brute-Force
🇮🇳
liveaspankaj
2026-02-12 11:44:11
(4 months ago)
DDoS attack on learngeeta.com: 276 requests of GET / HTTP/1.1 over plain HTTP with no referrer. Auto ...
show more
DDoS attack on learngeeta.com: 276 requests of GET / HTTP/1.1 over plain HTTP with no referrer. Automated bot attack with randomized User-Agents (outdated Chrome 127-129).
show less
DDoS Attack
🇭🇺
bcsaba
2026-01-24 12:28:51
(4 months ago)
Suricata: Alert - ET WEB_SERVER PHP tags in HTTP POST
Web App Attack
🇯🇵
VXG-NET
2026-01-21 19:31:49
(4 months ago)
port=80, indicator_type=info-leak
Hacking
🇺🇸
TPI-Abuse
2026-01-21 18:22:48
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 13:22:42.100594 2026] [security2:error] [pid 472:tid 472] [client 118.107.3.221:42412] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.clayrivers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.clayrivers.com"] [uri "/cgi-bin/php.exe"] [unique_id "aXEZcrNFsmBCuCFjzRn6EQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-21 04:22:11
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 23:22:03.843970 2026] [security2:error] [pid 29656:tid 29656] [client 118.107.3.221:38658] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||urlpick.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "urlpick.com"] [uri "/index.php"] [unique_id "aXBUawFf3SWZV9HRM6hCswAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-20 11:04:19
(4 months ago)
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 118.107.3.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 06:04:10.234143 2026] [security2:error] [pid 3823970:tid 3824014] [client 118.107.3.221:51572] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aspencommission.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aspencommission.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aW9hKi7VhUetUxVXnlhsdQAAAIA"]
show less
Brute-Force
Bad Web Bot
Web App Attack